Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-46995

CVE-2024-46995: baserCMS has a Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request

6.1

CVSS Score
3.0

Basic Information

CVE ID
CVE-2024-46995
GHSA ID
GHSA-mr7q-fv7j-jcgv
EPSS Score
0.26545%
CWE
CWE-79
Published
10/24/2024
Updated
10/24/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
baserproject/basercmscomposer<= 5.1.15.1.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability manifests in HTTP 400 error page generation, which typically involves displaying request details. In MVC frameworks like baserCMS (CakePHP-based), error handling is centralized in ErrorController. The _getErrorPageContent method is a probable candidate as it would process error templates and inject request parameters into the response. The XSS occurs when user-supplied input (e.g., malicious URL parameters triggering 400 errors) is reflected without proper HTML escaping. Confidence is medium due to lack of direct code access, but aligns with described vulnerability mechanics and framework architecture patterns.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

XSS vuln*r**ility in *TTP *** *** R*qu*st to **s*r*MS. ### T*r**t **s*r*MS *.*.* *n* **rli*r v*rsions ### Vuln*r**ility M*li*ious *o** m*y ** *x**ut** in *TTP *** *** R*qu*st. ### *ount*rm**sur*s Up**t* to t** l*t*st v*rsion o* **s*r*MS Pl**s* r*

Reasoning

T** vuln*r**ility m*ni**sts in *TTP *** *rror p*** **n*r*tion, w*i** typi**lly involv*s *ispl*yin* r*qu*st **t*ils. In MV* *r*m*works lik* **s*r*MS (**k*P*P-**s**), *rror **n*lin* is **ntr*liz** in `*rror*ontroll*r`. T** `_**t*rrorP****ont*nt` m*t*o*