Description
BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | baserproject/basercms | < 1.6.12 | 1.6.12 | GHSA-6wr6-54mw-mvhr |
References
- http://basercms.net/patch/JVN09789751
- JVNDB-2011-000066 third-party-advisory
- JVN#16617002 third-party-advisory