CVE-2024-46998: baserCMS XSS Vulnerability in Edit Email Form Settings
Summary
CVE-2024-46998: baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature. Affects baserproject/basercms versions < 5.1.2. Fixed in 5.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
baserCMS is an open-source content management system (CMS) designed for building and managing websites. It offers a user-friendly interface and a variety of features for content creation, management, and customization. However, versions 5.1.1 and earlier are vulnerable to a Cross-site Scripting (XSS) issue in the Edit Email Form Settings feature, which can allow attackers to execute malicious scripts.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the Edit Email Form Settings feature of baserCMS. This flaw allows an attacker to inject malicious JavaScript code that can be executed in the context of a user's browser session. The ramifications include unauthorized actions being performed on behalf of the user, data theft, and potential compromise of user accounts. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating a significant security risk.
How To Fix
Minimum fixed version
5.1.2
This is the first release that contains the fix.
composer require baserproject/basercms:5.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Edit Email Form Settings feature until they can update to a patched version. This can be done by modifying user permissions in the baserCMS admin panel.
Conclusion
The XSS vulnerability in baserCMS's Edit Email Form Settings poses a significant risk to users of versions 5.1.1 and earlier. It is crucial to update to version 5.1.2 or later to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for baserproject/basercms →
FAQ
The vulnerability is a Cross-site Scripting (XSS) issue that allows attackers to execute malicious scripts in the context of a user's browser.
baserCMS versions 5.1.1 and earlier are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
If you cannot update immediately, consider restricting access to the affected feature as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
