GHSA-6fmv-q269-55cwhigh7.2
Edit template, Remote Code Execution (RCE) Vulnerability in Latest Release 4.4.0
The advisory, in context
baserCMS 4.4.0 and earlier is affected by Remote Code Execution (RCE).
Impact: XSS via Arbitrary script execution. Attack vector is: Administrator must be logged in. Components are: Edit template. Tested baserCMS Version : 4.4.0 (Latest) Affected baserCMS Version : 4.0.0 ~ 4.4.0 Patches : https://basercms.net/security/20201029 Found by Aquilao Null
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
baserproject/basercms Packagist
Ecosystem versions
From 4.4.0 before 4.4.1
Fixed in 4.4.1
1 explicitly affected versions
4.4.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.4.0"
]
}