GHSA-7rpc-9m88-cf9w

OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-41243

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	baserproject/basercms	< 4.5.4	4.5.4

Details

As written in the advisory (Markdown source, shown as plain text).

There is an OS Command Injection Vulnerability on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible. Target baserCMS 4.5.3 and earlier versions Vulnerability OS Command Injection Vulnerability. Countermeasures Update to the latest version of baserCMS Credits Akagi Yusuke @NTT-ME

References

External links from the advisory. They lead to third-party sites.

https://github.com/baserproject/basercms/security/advisories/GHSA-7rpc-9m88-cf9w web
https://nvd.nist.gov/vuln/detail/CVE-2021-41243 advisory
https://github.com/baserproject/basercms/commit/9088b99c329d1faff3a2f1269f37b9a9d8d5f6ff web
https://github.com/baserproject/basercms package