CVE-2023-43649
baserCMS CSRF vulnerability in Content preview Feature
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
baserCMS CSRF vulnerability in Content preview Feature
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.
- Record
CVE-2023-43649- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2023-2734
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.
- Record
EUVD-2023-2734- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fw9x-cqjq-7jx5
baserCMS CSRF vulnerability in Content preview Feature
There is a CSRF Vulnerability in Content preview Feature to baserCMS.
This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.
Target
baserCMS 4.7.8 and earlier versions
Vulnerability
Malicious code may be executed in Content preview Feature.
Countermeasures
Update to the latest version of baserCMS
Please refer to the following page to reference for more information. https://basercms.net/security/JVN_45547161
Credits
Shiga Takuma@BroadBand Security, Inc
- Record
GHSA-fw9x-cqjq-7jx5- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.
- Record
CVE-2023-43649- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
baserCMS CSRF vulnerability in Content preview Feature
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.
- Record
CVE-2023-43649- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-fw9x-cqjq-7jx5
baserCMS CSRF vulnerability in Content preview Feature
There is a CSRF Vulnerability in Content preview Feature to baserCMS.
This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.
Target
baserCMS 4.7.8 and earlier versions
Vulnerability
Malicious code may be executed in Content preview Feature.
Countermeasures
Update to the latest version of baserCMS
Please refer to the following page to reference for more information. https://basercms.net/security/JVN_45547161
Credits
Shiga Takuma@BroadBand Security, Inc
- Record
GHSA-fw9x-cqjq-7jx5- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
baserproject/basercmsPackagist |
before 4.8.0 | 4.8.0 |
baserproject/basercmsPackagist |
before 4.8.0, plus listed versions 0.0.10.0.20.0.30.0.40.0.5 Show 45 moreShow less0.0.60.0.70.0.81.0.02.0.0-rc12.0.0-rc22.0.0-rc32.0.0-rc42.0.0-rc52.0.0-rc63.0.103.0.10.13.0.113.0.11.13.0.123.0.133.0.143.0.153.0.163.0.173.0.183.0.193.0.203.0.213.0.223.0.233.0.243.0.253.0.263.0.73.0.7.13.0.83.0.8.13.0.93.0.9.14.0.04.0.0-beta4.0.14.0.104.0.10.14.0.114.0.24.0.2.14.0.34.0.4 |
4.8.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-43649 is a medium vulnerability (CVSS 4.7) in Basercms, published October 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in baserproject/basercms 4.8.0.
References
github.com/baserproject/basercms/security/advisories/GHSA-fw9x-cqjq-7jx5
basercms.net/security/JVN_99052047
nvd.nist.gov/vuln/detail/CVE-2023-43649
Left out here: 62 versions. The JSON record has them.