[Japanese]

JVNDB-2024-000022

Multiple vulnerabilities in baserCMS

Overview

baserCMS provided by baserCMS Users Community contains multiple vulnerabilities listed below.


  • Reflected cross-site scripting vulnerability in Site search Feature (CWE-79) - CVE-2023-44379

  • Stored cross-site scripting vulnerability in Content Management (CWE-79) - CVE-2024-26128

  • OS command injection vulnerability (CWE-78) - CVE-2023-51450



CVE-2023-44379
Yusuke Uchida of PERSOL CROSS TECHNOLOGY CO., LTD. (Not affiliated at the time of report submission) reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

CVE-2024-26128
Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

CVE-2023-51450
Shunsuke Tanizaki reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 8.1 (High) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS V2 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
The above CVSS base scores have been assigned for CVE-2023-51450

CVSS V3 Severity:
Base Metrics 6.1 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 4.3 (Low) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
The above CVSS base scores have been assigned for CVE-2023-44379

CVSS V3 Severity:
Base Metrics 5.4 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 3.5 (Low) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: Single
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
The above CVSS base scores have been assigned for CVE-2024-26128
Affected Products


baserCMS Users Community
  • baserCMS 5.0.8 and earlier

Impact


  • An arbitrary script may be executed on the web browser of the user who accessed the site using the product - CVE-2023-44379

  • An arbitrary script may be executed on the web browser of the user who accessed the administrative page of the product - CVE-2024-26128

  • An arbitrary OS command may be executed by a remote attacker - CVE-2023-51450

Solution

[Update the Software]
Update the software to the latest version according to the information provided by the developer.
The developer has released baserCMS 5.0.10 that contains fixes for the vulnerabilities.
Vendor Information

baserCMS Users Community
CWE (What is CWE?)

  1. OS Command Injection(CWE-78) [IPA Evaluation]
  2. Cross-site Scripting(CWE-79) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2023-44379
  2. CVE-2024-26128
  3. CVE-2023-51450
References

  1. JVN : JVN#73283159
Revision History

  • [2024/02/27]
      Web page was published
  • [2024/04/16]
      Overview was modified

Date Public2024/02/27
Date First Published2024/02/27
Date Last Updated2024/02/27