Cross Site Scripting and RCE in baserCMS

CAO 7.6CVE-2020-15159 · GHSA-673x-f5wx-fxpw · Công bố 28/08/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-15159 là lỗ hổng mức CAO (CVSS 7.6) ảnh hưởng baserproject/basercms, basercms (basercms).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.2%, cao hơn 82.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.3.7 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
baserproject/basercms Packagist	`≥ 4.0.0, < 4.3.7`	`4.3.7`
basercms basercms	`≤ 4.3.6`	Chưa có bản vá

Mô tả

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).

Impact: XSS to RCE via Arbitrary file upload.
Attack vector is: Administrator must be logged in.
Components are: ThemeFilesController.php, UploaderFilesController.php.
Tested baserCMS Version : 4.3.6 (Latest)
Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
Patches : https://basercms.net/security/20200827

Found by Vulnerability Research team in Flatt Security Inc.

Mô tả của NVD

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.