CVE-2022-39325 json
Cross-site scripting vulnerability in BaserCMS
published 2022-11-25 3 y ago modified 2026-09-10 1 mo ago also GHSA-395x-wv32-44v5 , EUVD-2022-7204
- cvss
- 4.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
BaserCMS is a content management system with a japanese language focus. In affected versions there is a cross-site scripting vulnerability on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. Users of baserCMS are advised to upgrade as soon as possible. There are no known workarounds for this vulnerability.
Patch / fix
- packagist baserproject/basercms 4.7.2
- basercms basercms 4.7.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | baserproject/basercms | <4.7.2 |
4.7.2 |
Affected products
- baserproject basercms
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/baserproject/basercms/commit/b6f8a54e90dee51317eddf517b776fe8b4cd3ef6
web, patch, third-party-advisory
-
basercms.net
/security/JVN_53682526
web, vendor-advisory
-
github.com
/baserproject/basercms/security/advisories/GHSA-395x-wv32-44v5
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-39325
advisory
-
github.com
/baserproject/basercms
package
-
github.com
/baserproject/basercms/releases/tag/basercms-4.7.2
web
Sources
- CVE List CVE-2022-39325
- GitHub Advisory GHSA-395x-wv32-44v5
- NVD CVE-2022-39325
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.