CVE-2020-15154CWE-79

Cross Site Scripting in baserCMS

High · published August 28, 2020

CVSS v3.1
7.3
EPSS
1%
Percentile
62.8
In the wild
Unconfirmed
What it is

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components are: content_fields.php, content_info.php, content_options.php, content_related.php, index_list_tree.php, jquery.bcTree.js. The issue is fixed in version 4.3.7.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01011 · 62.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-08-28T21:10Z
EPSS history
Timeline
  • 28 AUG 21:10Z
    Cross Site Scripting in baserCMS
    cvelistv5