Lucene search

GitHub_MCVELIST:CVE-2023-25654

HistoryMar 23, 2023 - 7:22 p.m.

CVE-2023-25654 baserCMS File Uploader Remote Code Execution (RCE) vulnerability

2023-03-2319:22:30

CWE-434

GitHub_M

www.cve.org

cve-2023-25654

basercms

file uploader

remote code execution

vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.029

Percentile

91.1%

JSON

baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.

CNA Affected

[
  {
    "vendor": "baserproject",
    "product": "basercms",
    "versions": [
      {
        "version": "< 4.7.4",
        "status": "affected"
      }
    ]
  }
]

References

github.com/baserproject/basercms/commit/002886be0998c74c386e04f0b43688a8a45d7a96

github.com/baserproject/basercms/commit/08247f0a633d8e836ce2e5cd2d53aa19901a1359

github.com/baserproject/basercms/commit/60f83054d8131b0ace60716cec7e629b5eb3a8f0

github.com/baserproject/basercms/releases/tag/basercms-4.7.5

github.com/baserproject/basercms/security/advisories/GHSA-h4cc-fxpp-pgw9

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.029

Percentile

91.1%

JSON

Related for CVELIST:CVE-2023-25654