HIGH7.3

GHSA-4r3m-j6x5-48m3

Cross Site Scripting(XSS) Vulnerability in Latest Release 4.3.6 Site basic settings

Quick fix

GHSA-4r3m-j6x5-48m3 — baserproject/basercms: upgrade to the fixed version with the command below.

composer require baserproject/basercms:^4.3.7

Details

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/baserproject/basercms

Introduced in: 4.0.0Fixed in: 4.3.7

Fixcomposer require baserproject/basercms:^4.3.7

References

https://github.com/baserproject/basercms/security/advisories/GHSA-4r3m-j6x5-48m3[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2020-15155[ADVISORY]
https://github.com/baserproject/basercms/commit/94cbfab74c9fd6d04492597a1a684674c3c0e30f[WEB]
https://basercms.net/security/20200827[WEB]