VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 26, 2021· Updated Aug 3, 2024

CVE-2021-20683

CVE-2021-20683

Description

Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
baserproject/basercmsPackagist
< 4.4.54.4.5

Affected products

1

Patches

1
88ccc61e5656

指摘事項修正

https://github.com/baserproject/basercmsgondohMar 1, 2021via ghsa
commit
3 files changed · +14 −4
  • lib/Baser/Controller/PluginsController.php+11 −1 modified
    @@ -120,7 +120,17 @@ public function admin_add()
 		$plugin = explode(DS, $plugin);
 		$plugin = $plugin[0];
 		$srcPluginPath = APP . 'Plugin' . DS . $plugin;
-		$Folder = new Folder();
+		$Folder = new Folder($srcPluginPath);
+		// .htacessファイルが含まれる場合はアップロード不可
+		$htaccessFiles = $Folder->findRecursive('.*\.htaccess');
+		if ($htaccessFiles) {
+			$msg = __d('baser', '.htaccessファイルが含まれるプラグインはアップロードできません。');
+			$Folder->delete();
+			$this->BcMessage->setError($msg);
+			$this->redirect(['action' => 'add']);
+			return;
+		}
+
 		$Folder->chmod($srcPluginPath, 0777);
 		$tgtPluginPath = APP . 'Plugin' . DS . Inflector::camelize($plugin);
 		if ($srcPluginPath != $tgtPluginPath) {
  • lib/Baser/Model/BcAppModel.php+2 −2 modified
    @@ -1900,10 +1900,10 @@ public function containsScript($check)
 		if (preg_match('/(<\?=|<\?php|<script)/i', $value)) {
 			return false;
 		}
-		if (preg_match('/<[^>]+?(' . implode('|', $events) . ')=("|\')[^>]*?>/i', $value)) {
+		if (preg_match('/<[^>]+?(' . implode('|', $events) . ')\s*=[^<>]*?>/i', $value)) {
 			return false;
 		}
-		if (preg_match('/href=\s*?("|\')[^"\']*?javascript\s*?:/i', $value)) {
+		if (preg_match('/href\s*=\s*[^>]*?javascript\s*?:/i', $value)) {
 			return false;
 		}
 		return true;
  • lib/Baser/VERSION.txt+1 −1 modified
    @@ -1,4 +1,4 @@
-4.4.4
+4.4.5-dev
 
 ///////////////////////////////////////////////////////////////////////////////////////////////////////////
 // +---------------------------------------------------------------------------------------------------+ //

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.