-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability explicitly involves bypassing access controls in the mail form's file attachment functionality. The description indicates attackers can view uploaded files via unspecified vectors, which implies a missing authorization check in the file retrieval mechanism. In CMS architectures, file access is typically handled by controller actions. The MailFilesController::view action (or equivalent) would be responsible for serving uploaded mail attachments. The lack of proper access control in this function allows unauthenticated users to access files by directly invoking the endpoint with a known file identifier. This matches the CWE-200 pattern of exposing sensitive data through missing authorization checks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| baserproject/basercms | composer | >= 4.0.0, <= 4.1.0.1 | |
| baserproject/basercms | composer | <= 3.0.15 |
PHPPHP