CVE-2020-15273 : Security Advisory and Response

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting affecting various components. Learn about the impact, technical details, and mitigation steps.

Understanding CVE-2020-15273

What is CVE-2020-15273?

baserCMS before version 4.4.1 is susceptible to Cross-Site Scripting, allowing arbitrary JavaScript execution through specific characters in account-accessible functions.

The Impact of CVE-2020-15273

The vulnerability has a CVSS base score of 7.3 (High severity) with confidentiality, integrity, and privileges required all rated as High.

Technical Details of CVE-2020-15273

Vulnerability Description

Arbitrary JavaScript execution in baserCMS before version 4.4.1
Affected components: Edit feed settings, Edit widget area, Sub site new registration, New category registration

Affected Systems and Versions

Product: basercms
Vendor: baserproject
Vulnerable versions: >= 4.0.0, < 4.4.1

Exploitation Mechanism

Specific characters in account-accessible functions allow execution of arbitrary JavaScript

Mitigation and Prevention

Immediate Steps to Take

Update baserCMS to version 4.4.1 or later
Avoid inputting suspicious characters in account functions

Long-Term Security Practices

Regularly update software and apply security patches
Educate users on safe browsing practices

Patching and Updates

Apply patches provided by baserproject to fix the vulnerability