CVE-2024-46995: baserCMS Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request
Summary
CVE-2024-46995: baserCMS has a Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request. Affects baserproject/basercms versions < 5.1.2. Fixed in 5.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
baserCMS is an open-source content management system (CMS) designed for building and managing websites with ease. It offers a range of features including customizable templates, user management, and plugin support, making it a popular choice for developers and businesses. However, versions 5.1.1 and earlier are susceptible to a Cross-site Scripting (XSS) vulnerability that can be exploited through malformed HTTP requests.
Vulnerability Detail
The vulnerability arises from the improper handling of HTTP 400 Bad Request responses in baserCMS. Attackers can inject malicious scripts into the request, which may then be executed in the context of the user's browser. This could lead to unauthorized actions being performed on behalf of the user, data theft, or session hijacking. The vulnerability is classified under CWE-79, indicating its nature as a Cross-site Scripting issue.
How To Fix
Minimum fixed version
5.1.2
This is the first release that contains the fix.
composer require baserproject/basercms:5.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation on your web server to filter out potentially malicious requests. However, this is not a substitute for updating the software.
Conclusion
In summary, baserCMS versions 5.1.1 and earlier are vulnerable to a Cross-site Scripting (XSS) vulnerability that can be exploited through HTTP 400 Bad Request responses. It is crucial to update to version 5.1.2 or later to safeguard against potential attacks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities in your open-source dependencies.
See every vulnerability recorded for baserproject/basercms →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and session hijacking, compromising user security.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the composer.lock file.
If you cannot update immediately, implement input validation on your server to mitigate the risk until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
