baserproject/basercms · Security
baserCMS OS command injection vulnerability in Installer
- GHSA ID
- GHSA-77fc-4cv5-hmfr
- CVE ID
- CVE-2023-51450
- Severity
- medium
- Published
- Updated
- CVSS
- 5.6 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- CVSS v3
- 5.6 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Description
There is a OS command injection in Installer Feature to baserCMS.
Target
baserCMS 5.0.8 and earlier versions
Vulnerability
Malicious command may be executed in Installer.
Countermeasures
Update to the latest version of baserCMS
Please refer to the following page to reference for more information. https://basercms.net/security/JVN_73283159
CWEs
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-51450 ↗
- https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c ↗
- https://basercms.net/security/JVN_09767360 ↗
- https://github.com/advisories/GHSA-77fc-4cv5-hmfr ↗