MEDIUM4.8

GHSA-fx2m-5m9v-jhgp

XSS in baserCMS before 4.1.4

Quick fix

GHSA-fx2m-5m9v-jhgp — baserproject/basercms: upgrade to the fixed version with the command below.

composer require baserproject/basercms:^4.1.4

Details

An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the `data[UploaderCategory][name]` parameter to an `admin/uploader/uploader_categories/edit` URI.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/baserproject/basercms

Introduced in: 0Fixed in: 4.1.4

Fixcomposer require baserproject/basercms:^4.1.4

References

https://nvd.nist.gov/vuln/detail/CVE-2018-18943[ADVISORY]
https://web.archive.org/web/20200130073341/https://basercms.net/release/4_1_4[WEB]
https://web.archive.org/web/20211209034642/http://sunu11.com/2018/10/31/baserCMS[WEB]