CVE-2023-51450: baserCMS OS Command Injection Vulnerability in Installer
Summary
CVE-2023-51450: baserCMS OS command injection vulnerability in Installer. Affects baserproject/basercms versions < 5.0.9. Fixed in 5.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
baserCMS is an open-source content management system (CMS) developed by baserproject. It provides a platform for creating and managing websites, with features such as user management, content editing, and plugin support. The Installer feature in baserCMS allows users to set up and configure the CMS on their server. However, versions 5.0.8 and earlier are vulnerable to an OS command injection attack in the Installer.
Vulnerability Detail
The vulnerability in baserCMS Installer allows an attacker to execute malicious commands on the server. By exploiting this vulnerability, an attacker can gain unauthorized access, escalate privileges, or perform other malicious activities. This can lead to the compromise of sensitive data, disruption of services, or unauthorized control of the affected system. The vulnerability is rated as moderate with a CVSS score of 5.6.
How To Fix
Minimum fixed version
5.0.9
This is the first release that contains the fix.
composer require baserproject/basercms:5.0.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update baserCMS to the latest version to fix the vulnerability.
Conclusion
The baserCMS OS command injection vulnerability in the Installer feature can be mitigated by updating to the latest version of baserCMS. It is crucial to keep software up to date to ensure the security and integrity of the system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for baserproject/basercms →
FAQ
baserCMS is an open-source content management system (CMS) developed by baserproject. It provides a platform for creating and managing websites.
The Installer feature in baserCMS allows users to set up and configure the CMS on their server.
Versions 5.0.8 and earlier of baserCMS are affected by this vulnerability.
This vulnerability allows an attacker to execute malicious commands on the server, potentially leading to unauthorized access, privilege escalation, or other malicious activities.
To fix this vulnerability, update baserCMS to the latest version (5.0.9 or later) that includes a patch for the OS command injection vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
