Description
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| baserproject | basercms | unspecified – < < 4.3.7 | < 4.3.7 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | baserproject/basercms | >= 4.0.0, < 4.3.7 | 4.3.7 | GHSA-673x-f5wx-fxpw |