by Kastro
Paper/Archive/CVE-2023-25654

CVE-2023-25654

baserproject basercms — baserCMS File Uploader Remote Code Execution (RCE) vulnerability

EPSS 2%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.8.748 × 2015.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.

Affected

ProductAffectedFixed inSource
basercms< 4.7.4–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/baserproject/basercms/security/advisories/GHSA-h4cc-fxpp-pgw9refgithub.com/baserproject/basercms/commit/002886be0998c74c386e04f0b43688a8a45d7a96refgithub.com/baserproject/basercms/commit/08247f0a633d8e836ce2e5cd2d53aa19901a1359refgithub.com/baserproject/basercms/commit/60f83054d8131b0ace60716cec7e629b5eb3a8f0refgithub.com/baserproject/basercms/releases/tag/basercms-4.7.5