CVE-2020-15159

Katalog CVE

CVSS 7.6 · High EPSS 2,2%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada basercms. Skor CVSS 3.1 7.6 (High) menurut NVD.

Deskripsi (NVD)

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.

Rincian

Terbit di NVD

28 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 81,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://basercms.net/security/20200827 advisory vendor
• https://github.com/baserproject/basercms/commit/16a7b3cd09a0ca355474119c76897eac2034a66d patch · advisory pihak ketiga
• https://github.com/baserproject/basercms/security/advisories/GHSA-673x-f5wx-fxpw patch · advisory pihak ketiga