Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-43649

CVE-2023-43649:
baserCMS CSRF vulnerability in Content preview Feature

4.7

CVSS Score
3.0

Basic Information

CVE ID
CVE-2023-43649
GHSA ID
GHSA-fw9x-cqjq-7jx5
EPSS Score
0.29845%
CWE
CWE-352
Published
10/26/2023
Updated
11/9/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
baserproject/basercmscomposer< 4.8.04.8.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit diff shows the removal of $controller->Security->csrfCheck = false in BcContentsComponent.php. This line explicitly disabled CSRF validation for content preview requests, creating the vulnerability. The CWE-352 (CSRF) classification and the patch's focus on re-enabling CSRF checks confirm this function's role in the exploit.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T**r* is * *SR* Vuln*r**ility in *ont*nt pr*vi*w ***tur* to **s*r*MS. T*is is * vuln*r**ility t**t n***s to ** ***r*ss** w**n t** m*n***m*nt syst*m is us** *y *n unsp**i*i** num**r o* us*rs. I* you *r* *li*i*l*, pl**s* up**t* to t** n*w v*rsion *s s

Reasoning

T** *ommit *i** s*ows t** r*mov*l o* `$*ontroll*r->S**urity->*sr*****k = **ls*` in ***ont*nts*ompon*nt.p*p. T*is lin* *xpli*itly *is**l** *SR* v*li**tion *or *ont*nt pr*vi*w r*qu*sts, *r**tin* t** vuln*r**ility. T** *W*-*** (*SR*) *l*ssi*i**tion *n*