요약
- CVE-2020-15159은(는) baserproject/basercms, basercms (basercms)에 영향을 주는 높음 (CVSS 7.6) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 2.2%, 전체 취약점의 82.2%보다 높음.
- 조치: 4.3.7 이상으로 업데이트하세요.
Description
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).
- Impact: XSS to RCE via Arbitrary file upload.
- Attack vector is: Administrator must be logged in.
- Components are: ThemeFilesController.php, UploaderFilesController.php.
- Tested baserCMS Version : 4.3.6 (Latest)
- Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
- Patches : https://basercms.net/security/20200827
Found by Vulnerability Research team in Flatt Security Inc.
NVD description
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.
baserproject/basercms의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free