CVE-2023-25655: baserCMS allows any file to be uploaded
Summary
CVE-2023-25655: baserCMS allows any file to be uploaded. Affects baserproject/basercms versions < 4.7.5. Fixed in 4.7.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
baserCMS is a management system used by an unspecified number of users. It provides various functionalities for website management, content creation, and file uploading. However, versions 4.7.3 and earlier are vulnerable to a critical security issue that allows the upload of any files, including malicious ones.
Vulnerability Detail
The vulnerability in baserCMS allows attackers to upload arbitrary files through the Upload File Management feature. This can lead to various security risks, such as the execution of malicious code, unauthorized access to sensitive data, or the compromise of the entire system. It is crucial to address this vulnerability promptly to prevent potential attacks and protect the integrity of the system.
How To Fix
Minimum fixed version
4.7.5
This is the first release that contains the fix.
composer require baserproject/basercms:4.7.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in baserCMS that allows the upload of any files poses a significant security risk. It is crucial to update the software to the latest version (4.7.5 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for baserproject/basercms →
FAQ
baserCMS is a management system used for website management and content creation.
This vulnerability allows attackers to upload any files, including malicious ones, which can lead to various security risks.
You can fix this vulnerability by updating baserCMS to the latest version (4.7.5 or later).
Versions 4.7.3 and earlier are affected by this vulnerability.
No, the recommended fix is to update baserCMS to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
