CVE-2021-39136

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-39136
baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.

8.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

3.5 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://jvn.jp/en/jp/JVN14134801/index.html Third Party Advisory
https://basercms.net/security/JVN_14134801 Vendor Advisory
https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc Patch Third Party Advisory
https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3 Third Party Advisory
http://jvn.jp/en/jp/JVN14134801/index.html Third Party Advisory
https://basercms.net/security/JVN_14134801 Vendor Advisory
https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc Patch Third Party Advisory
https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*
History

21 Nov 2024, 06:18

Type Values Removed Values Added
CVSS v2 : 3.5
v3 : 5.4 		v2 : 3.5
v3 : 8.7
References () http://jvn.jp/en/jp/JVN14134801/index.html - Third Party Advisory () http://jvn.jp/en/jp/JVN14134801/index.html - Third Party Advisory
References () https://basercms.net/security/JVN_14134801 - Vendor Advisory () https://basercms.net/security/JVN_14134801 - Vendor Advisory
References () https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc - Patch, Third Party Advisory () https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc - Patch, Third Party Advisory
References () https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3 - Third Party Advisory () https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3 - Third Party Advisory

30 Aug 2021, 17:45

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.7 		v2 : 3.5
v3 : 5.4
CPE cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*
References (MISC) https://basercms.net/security/JVN_14134801 - (MISC) https://basercms.net/security/JVN_14134801 - Vendor Advisory
References (JVN) http://jvn.jp/en/jp/JVN14134801/index.html - (JVN) http://jvn.jp/en/jp/JVN14134801/index.html - Third Party Advisory
References (CONFIRM) https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3 - (CONFIRM) https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3 - Third Party Advisory
References (MISC) https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc - (MISC) https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc - Patch, Third Party Advisory

27 Aug 2021, 05:15

Type Values Removed Values Added
References
  • (JVN) http://jvn.jp/en/jp/JVN14134801/index.html -

25 Aug 2021, 19:21

Type Values Removed Values Added
New CVE
Information

Published : 2021-08-25 18:15

Updated : 2024-11-21 06:18

NVD link : CVE-2021-39136

Mitre link : CVE-2021-39136

CVE.ORG link : CVE-2021-39136

JSON object : View

Products Affected

basercms

  • basercms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')