jvndb - jvndb-2021-000080

jvndb-2021-000080

Vulnerability from jvndb

Published

2021-08-27 13:29

Modified

2021-08-27 13:29

Severity ?

4.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Summary

baserCMS vulnerable to cross-site scripting

Details

baserCMS provided by baserCMS Users Community contains a cross-site scripting vulnerability (CWE-79). Akagi Yusuke of NTT-ME CORPORATION reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN14134801/index.html
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39136
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-39136
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	baserCMS Users Community	baserCMS

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000080.html",
  "dc:date": "2021-08-27T13:29+09:00",
  "dcterms:issued": "2021-08-27T13:29+09:00",
  "dcterms:modified": "2021-08-27T13:29+09:00",
  "description": "baserCMS provided by baserCMS Users Community contains a cross-site scripting vulnerability (CWE-79).\r\n\r\nAkagi Yusuke of NTT-ME CORPORATION reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000080.html",
  "sec:cpe": {
    "#text": "cpe:/a:basercms:basercms",
    "@product": "baserCMS",
    "@vendor": "baserCMS Users Community",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "3.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000080",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN14134801/index.html",
      "@id": "JVN#14134801",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39136",
      "@id": "CVE-2021-39136",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-39136",
      "@id": "CVE-2021-39136",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "baserCMS vulnerable to cross-site scripting"
}

cve-2021-39136

Vulnerability from cvelistv5

Published

2021-08-25 18:05

Modified

2024-08-04 01:58

Severity ?

8.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Summary

Cross-site scripting vulnerability in file upload

References

▼	URL	Tags
	https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3	x_refsource_CONFIRM
	https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc	x_refsource_MISC
	https://basercms.net/security/JVN_14134801	x_refsource_MISC
	http://jvn.jp/en/jp/JVN14134801/index.html	third-party-advisory, x_refsource_JVN

Impacted products

Vendor

Product

Version

▼

baserproject

basercms

Version: < 4.5.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:58:17.928Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://basercms.net/security/JVN_14134801"
          },
          {
            "name": "JVN#14134801",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN14134801/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "basercms",
          "vendor": "baserproject",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-27T04:06:09",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://basercms.net/security/JVN_14134801"
        },
        {
          "name": "JVN#14134801",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN14134801/index.html"
        }
      ],
      "source": {
        "advisory": "GHSA-hgjr-632x-qpp3",
        "discovery": "UNKNOWN"
      },
      "title": "Cross-site scripting vulnerability in file upload",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-39136",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site scripting vulnerability in file upload"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "basercms",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 4.5.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "baserproject"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3",
              "refsource": "CONFIRM",
              "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3"
            },
            {
              "name": "https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc",
              "refsource": "MISC",
              "url": "https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc"
            },
            {
              "name": "https://basercms.net/security/JVN_14134801",
              "refsource": "MISC",
              "url": "https://basercms.net/security/JVN_14134801"
            },
            {
              "name": "JVN#14134801",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN14134801/index.html"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-hgjr-632x-qpp3",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-39136",
    "datePublished": "2021-08-25T18:05:13",
    "dateReserved": "2021-08-16T00:00:00",
    "dateUpdated": "2024-08-04T01:58:17.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted