CVE-2023-51450 - Vulnerability Details - OpenCVE

ReportizFlow

baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Basercms	Basercms

Configuration 1 [-]

cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://basercms.net/security/JVN_09767360
https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c
https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr

History

Wed, 18 Dec 2024 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Basercms Basercms basercms
CPEs		cpe:2.3:a:basercms:basercms::::::::
Vendors & Products		Basercms Basercms basercms

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-02-22T14:50:51.098Z

Updated: 2024-08-02T22:32:10.287Z

Reserved: 2023-12-19T15:19:39.615Z

Link: CVE-2023-51450

Vulnrichment

Updated: 2024-08-02T22:32:10.287Z

NVD

Status : Analyzed

Published: 2024-02-22T15:15:08.290

Modified: 2024-12-18T16:55:17.013

Link: CVE-2023-51450

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-51450", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-12-19T15:19:39.615Z", "datePublished": "2024-02-22T14:50:51.098Z", "dateUpdated": "2024-08-02T22:32:10.287Z"}, "containers": {"cna": {"title": "baserCMS OS command injection vulnerability in Installer", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr"}, {"name": "https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c", "tags": ["x_refsource_MISC"], "url": "https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c"}, {"name": "https://basercms.net/security/JVN_09767360", "tags": ["x_refsource_MISC"], "url": "https://basercms.net/security/JVN_09767360"}], "affected": [{"vendor": "baserproject", "product": "basercms", "versions": [{"version": "< 5.0.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-22T14:50:51.098Z"}, "descriptions": [{"lang": "en", "value": "baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability."}], "source": {"advisory": "GHSA-77fc-4cv5-hmfr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-51450", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-22T16:32:12.187899Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:21:55.047Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:32:10.287Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr"}, {"name": "https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c"}, {"name": "https://basercms.net/security/JVN_09767360", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://basercms.net/security/JVN_09767360"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr", "name": "https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c", "name": "https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://basercms.net/security/JVN_09767360", "name": "https://basercms.net/security/JVN_09767360", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:32:10.287Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-51450", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-22T16:32:12.187899Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:40.578Z"}}], "cna": {"title": "baserCMS OS command injection vulnerability in Installer", "source": {"advisory": "GHSA-77fc-4cv5-hmfr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "baserproject", "product": "basercms", "versions": [{"status": "affected", "version": "< 5.0.9"}]}], "references": [{"url": "https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr", "name": "https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c", "name": "https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c", "tags": ["x_refsource_MISC"]}, {"url": "https://basercms.net/security/JVN_09767360", "name": "https://basercms.net/security/JVN_09767360", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-22T14:50:51.098Z"}}}, "cveMetadata": {"cveId": "CVE-2023-51450", "state": "PUBLISHED", "dateUpdated": "2024-08-02T22:32:10.287Z", "dateReserved": "2023-12-19T15:19:39.615Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-02-22T14:50:51.098Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*", "matchCriteriaId": "26BF6684-E207-4771-9223-1B473F279058", "versionEndExcluding": "5.0.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability."}, {"lang": "es", "value": "baserCMS es un framework de desarrollo de sitios web. Antes de la versi\u00f3n 5.0.9, hab\u00eda una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en la funci\u00f3n de b\u00fasqueda de sitios de baserCMS. La versi\u00f3n 5.0.9 contiene una soluci\u00f3n para esta vulnerabilidad."}], "id": "CVE-2023-51450", "lastModified": "2024-12-18T16:55:17.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.4, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2024-02-22T15:15:08.290", "references": [{"source": "[email protected]", "tags": ["Broken Link"], "url": "https://basercms.net/security/JVN_09767360"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://basercms.net/security/JVN_09767360"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "[email protected]", "type": "Primary"}]}