CVE-2024-26128: baserCMS Cross-site Scripting vulnerability in Content Management
Summary
CVE-2024-26128: baserCMS Cross-site Scripting vulnerability in Content Management. Affects baserproject/basercms versions < 5.0.9. Fixed in 5.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
baserCMS is a content management system that allows users to create and manage websites. It provides features such as content management, user authentication, and template customization. The vulnerability affects baserCMS versions 5.0.8 and earlier. These versions are susceptible to a cross-site scripting (XSS) vulnerability in the Content Management feature.
Vulnerability Detail
The XSS vulnerability in baserCMS allows an attacker to inject malicious code into the Content Management feature. This can lead to the execution of arbitrary code in the context of the user's browser, potentially compromising the user's sensitive information or performing unauthorized actions on their behalf. The vulnerability is rated as moderate with a CVSS score of 5.4.
How To Fix
Minimum fixed version
5.0.9
This is the first release that contains the fix.
composer require baserproject/basercms:5.0.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The baserCMS Content Management feature is vulnerable to a cross-site scripting (XSS) attack. To mitigate this vulnerability, it is crucial to update baserCMS to version 5.0.9 or later. Regularly updating software components and following secure coding practices are essential for maintaining the security of your baserCMS installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for baserproject/basercms →
FAQ
baserCMS is a content management system that allows users to create and manage websites. It provides features such as content management, user authentication, and template customization.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the context of the user's browser.
The XSS vulnerability in baserCMS can lead to the execution of arbitrary code in the user's browser. This can result in the compromise of sensitive information, unauthorized actions performed on behalf of the user, or the manipulation of website content.
To protect your baserCMS installation, it is recommended to update to the latest version (5.0.9 or later) that includes patches for the XSS vulnerability. Additionally, it is good practice to regularly update all software components and follow secure coding practices.
You can find more information about this vulnerability, including technical details and the latest updates, on the baserCMS security page: https://basercms.net/security/JVN_73283159
References
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
