GitHub Advisoryadvisory · Packagist

GHSA-7rpc-9m88-cf9w OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS

CRITICAL Published 2021-12-01 Modified 2021-12-01 Official page ↗
Aliases
CVE-2021-41243
Ecosystem
Packagist
Packages
baserproject/basercms
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Weaknesses
CWE-78
Reviewed
2021-11-29

Affected packages

• Packagist baserproject/basercms: < 4.5.4 → fixed in 4.5.4

Description

There is an OS Command Injection Vulnerability on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible. Target baserCMS 4.5.3 and earlier versions Vulnerability OS Command Injection Vulnerability. Countermeasures Update to the latest version of baserCMS Credits Akagi Yusuke @NTT-ME

Related

Alias · CVE (1)

  • CVE-2021-41243 There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References