Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-46996

CVE-2024-46996:
baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature

6.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-46996
GHSA ID
GHSA-66jv-qrm3-vvfg
EPSS Score
0.3008%
CWE
CWE-79
Published
10/24/2024
Updated
10/28/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
baserproject/basercmscomposer<= 5.1.15.1.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability centers around improper input handling in blog post slugs (per JVN_00876083). In CakePHP-based baserCMS:

  1. Controller methods handling form submissions would be primary XSS vectors
  2. Model lifecycle hooks like beforeSave are common validation points
  3. Admin template rendering services often aggregate view variables While exact code isn't available, these components align with:
  • The 'slug handling insufficiency' description
  • Typical XSS patterns in MVC frameworks
  • The admin context requirement mentioned in advisories Confidence is medium due to inferred patterns rather than direct code observation

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

XSS vuln*r**ility in *lo* posts ***tur* to **s*r*MS. ### T*r**t **s*r*MS *.*.* *n* **rli*r v*rsions ### Vuln*r**ility M*li*ious *o** m*y ** *x**ut** in *lo* posts ***tur*. ### *ount*rm**sur*s Up**t* to t** l*t*st v*rsion o* **s*r*MS Pl**s* r***r

Reasoning

T** vuln*r**ility **nt*rs *roun* improp*r input **n*lin* in *lo* post slu*s (p*r JVN_********). In **k*P*P-**s** **s*r*MS: *. *ontroll*r m*t*o*s **n*lin* *orm su*missions woul* ** prim*ry XSS v**tors *. Mo**l li***y*l* *ooks lik* ***or*S*v* *r* *ommo