CVE-2023-44379 - Vulnerability Details - OpenCVE

baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Basercms	Basercms

Configuration 1 [-]

cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://basercms.net/security/JVN_73283159
https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4
https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87

History

Wed, 18 Dec 2024 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Basercms Basercms basercms
CPEs		cpe:2.3:a:basercms:basercms::::::::
Vendors & Products		Basercms Basercms basercms

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-02-22T14:47:14.333Z

Updated: 2024-08-02T20:07:33.116Z

Reserved: 2023-09-28T17:56:32.612Z

Link: CVE-2023-44379

Vulnrichment

Updated: 2024-08-02T20:07:33.116Z

NVD

Status : Analyzed

Published: 2024-02-22T15:15:08.060

Modified: 2024-12-18T16:54:13.977

Link: CVE-2023-44379

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-44379", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-09-28T17:56:32.612Z", "datePublished": "2024-02-22T14:47:14.333Z", "dateUpdated": "2024-08-02T20:07:33.116Z"}, "containers": {"cna": {"title": "baserCMS Cross-site Scripting vulnerability in Site search Feature", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87"}, {"name": "https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4", "tags": ["x_refsource_MISC"], "url": "https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4"}, {"name": "https://basercms.net/security/JVN_73283159", "tags": ["x_refsource_MISC"], "url": "https://basercms.net/security/JVN_73283159"}], "affected": [{"vendor": "baserproject", "product": "basercms", "versions": [{"version": "< 5.0.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-22T14:47:14.333Z"}, "descriptions": [{"lang": "en", "value": "baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability."}], "source": {"advisory": "GHSA-66c2-p8rh-qx87", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-44379", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-22T16:39:22.092743Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:21:55.451Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:07:33.116Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87"}, {"name": "https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4"}, {"name": "https://basercms.net/security/JVN_73283159", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://basercms.net/security/JVN_73283159"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87", "name": "https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4", "name": "https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://basercms.net/security/JVN_73283159", "name": "https://basercms.net/security/JVN_73283159", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:07:33.116Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-44379", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-22T16:39:22.092743Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:40.603Z"}}], "cna": {"title": "baserCMS Cross-site Scripting vulnerability in Site search Feature", "source": {"advisory": "GHSA-66c2-p8rh-qx87", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "baserproject", "product": "basercms", "versions": [{"status": "affected", "version": "< 5.0.9"}]}], "references": [{"url": "https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87", "name": "https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4", "name": "https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4", "tags": ["x_refsource_MISC"]}, {"url": "https://basercms.net/security/JVN_73283159", "name": "https://basercms.net/security/JVN_73283159", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-22T14:47:14.333Z"}}}, "cveMetadata": {"cveId": "CVE-2023-44379", "state": "PUBLISHED", "dateUpdated": "2024-08-02T20:07:33.116Z", "dateReserved": "2023-09-28T17:56:32.612Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-02-22T14:47:14.333Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*", "matchCriteriaId": "26BF6684-E207-4771-9223-1B473F279058", "versionEndExcluding": "5.0.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability."}, {"lang": "es", "value": "baserCMS es un framework de desarrollo de sitios web. Antes de la versi\u00f3n 5.0.9, hab\u00eda una vulnerabilidad de cross site scripting en la funci\u00f3n de b\u00fasqueda de sitios. La versi\u00f3n 5.0.9 contiene una soluci\u00f3n para esta vulnerabilidad."}], "id": "CVE-2023-44379", "lastModified": "2024-12-18T16:54:13.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-22T15:15:08.060", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://basercms.net/security/JVN_73283159"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://basercms.net/security/JVN_73283159"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}