CVE-2024-46996: baserCMS XSS Vulnerability in Blog Posts Feature
Summary
CVE-2024-46996: baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature. Affects baserproject/basercms versions < 5.1.2. Fixed in 5.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
baserCMS is an open-source content management system (CMS) designed for building and managing websites. It offers a user-friendly interface, customizable themes, and various plugins to enhance functionality. The platform is widely used for blogging and content publishing. However, versions 5.1.1 and earlier are susceptible to a Cross-site Scripting (XSS) vulnerability in the Blog posts feature, which can allow attackers to execute malicious scripts.
Vulnerability Detail
The XSS vulnerability in baserCMS arises from insufficient input validation in the Blog posts feature. This flaw allows an attacker to inject malicious JavaScript code into blog posts, which can be executed in the context of users viewing the posts. The potential ramifications include unauthorized actions performed on behalf of users, data theft, and the spread of malware. The vulnerability is classified under CWE-79, indicating its nature as a cross-site scripting issue.
How To Fix
Minimum fixed version
5.1.2
This is the first release that contains the fix.
composer require baserproject/basercms:5.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the Blog posts feature until the update is applied. This can be done by navigating to the settings in the baserCMS admin panel and turning off the Blog functionality.
Conclusion
The XSS vulnerability in baserCMS's Blog posts feature poses a significant risk to users of versions 5.1.1 and earlier. It is crucial to update to version 5.1.2 or later to mitigate this risk. Users are also encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can alert them in real-time.
See every vulnerability recorded for baserproject/basercms →
FAQ
The vulnerability is a Cross-site Scripting (XSS) issue that allows attackers to inject malicious scripts into blog posts.
baserCMS versions 5.1.1 and earlier are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
If you cannot update immediately, consider disabling the Blog posts feature as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
