CVE-2020-15159CWE-79

Cross Site Scripting leading to RCE in baserCMS

High · published August 28, 2020

CVSS v3.1
7.6
EPSS
2%
Percentile
82.0
In the wild
Unconfirmed
What it is

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02152 · 82.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-08-28T21:55Z
EPSS history
Timeline
  • 28 AUG 21:55Z
    Cross Site Scripting leading to RCE in baserCMS
    cvelistv5