JVN#53682526
Multiple cross-site scripting vulnerabilities in baserCMS

Overview

baserCMS provided by baserCMS Users Community contains multiple cross-site scripting vulnerabilities.

Products Affected

• baserCMS versions prior to 4.7.2

Description

baserCMS provided by baserCMS Users Community contains multiple cross-site scripting vulnerabilities listed below.

• Stored cross-site scripting vulnerability in User management (CWE-79) - CVE-2022-39325

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	Base Score: 4.8
  CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

• Stored cross-site scripting vulnerability in Permission Settings (CWE-79) - CVE-2022-41994

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	Base Score: 4.8
  CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

• Stored cross-site scripting vulnerability in User group management (CWE-79) - CVE-2022-42486

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	Base Score: 4.8
  CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

Impact

An arbitrary script may be executed on the web browser of the user who is accessing the administrative page of the product.

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.
The developer released baserCMS 4.7.2 that contains a fix for these vulnerabilities.