CVE-2024-46994: baserCMS Cross-site Scripting (XSS) Vulnerability in Blog Posts and Contents List Feature
Summary
CVE-2024-46994: baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts and Contents list Feature. Affects baserproject/basercms versions < 5.1.2. Fixed in 5.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
baserCMS is an open-source content management system (CMS) designed for creating and managing websites. It provides a user-friendly interface and a range of features for blog management, content creation, and site customization. However, versions 5.1.1 and earlier are vulnerable to a Cross-site Scripting (XSS) attack, which can allow attackers to execute malicious scripts in the context of a user's browser.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the Blog posts and Contents list feature of baserCMS. This oversight allows attackers to inject malicious scripts that can be executed when other users view the affected content. The potential ramifications include unauthorized access to user sessions, data theft, and the spread of malware. The vulnerability is classified under CWE-79, indicating a failure to properly sanitize user input, leading to XSS attacks.
How To Fix
Minimum fixed version
5.1.2
This is the first release that contains the fix.
composer require baserproject/basercms:5.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Blog posts and Contents list feature until the update is applied. Additionally, implementing input validation and output encoding can help mitigate the risk of XSS attacks.
Conclusion
The baserCMS Cross-site Scripting (XSS) vulnerability (CVE-2024-46994) poses a significant risk to users of versions 5.1.1 and earlier. It is crucial to update to version 5.1.2 or later to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can provide real-time alerts without requiring code access.
See every vulnerability recorded for baserproject/basercms →
FAQ
The vulnerability is a Cross-site Scripting (XSS) issue that allows attackers to execute malicious scripts in the context of a user's browser.
baserCMS versions 5.1.1 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider restricting access to the affected features and implementing input validation as a temporary measure.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
