{"id":"CVE-2011-2674","aliases":["EUVD-2022-2872","GHSA-6wr6-54mw-mvhr"],"status":"published","title":"BaserCMS privilege escallation","description":"BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.","severity":{"version":"2.0","score":4.9,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01344,"percentile":0.71578,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-269"],"published":"2011-10-02T01:00:00Z","modified":"2026-09-10T03:49:31Z","fixes":[{"ecosystem":"Packagist","package":"baserproject/basercms","fixed_in":["1.6.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"baserproject/basercms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12"}]}]},{"source":"osv","ecosystem":"Packagist","package":"baserproject/basercms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","1.0.0"]}],"products":[{"vendor":"basercms","product":"basercms"}],"references":[{"url":"http://basercms.net/patch/JVN09789751","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2011-000066","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred","web"]},{"url":"http://jvn.jp/en/jp/JVN16617002/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2674","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6wr6-54mw-mvhr"},{"url":"https://github.com/baserproject/basercms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2011-2674","description":"BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.","status":"published","published":"2011-10-02T01:00:00Z","modified":"2024-09-17T01:31:21.534Z","updated_at":"2026-11-02T14:35:36.603688Z"}],"euvd":[{"id":"EUVD-2022-2872","description":"BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.","status":"published","published":"2011-10-02T01:00:00Z","modified":"2024-09-17T01:31:21Z","updated_at":"2026-11-03T00:28:48.901339Z"}],"ghsa":[{"id":"GHSA-6wr6-54mw-mvhr","title":"BaserCMS privilege escallation","description":"BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.","status":"published","published":"2022-05-13T01:08:49Z","modified":"2024-01-15T18:23:43Z","cwes":["CWE-269"],"updated_at":"2026-11-02T14:37:31.550603Z"}],"nvd":[{"id":"CVE-2011-2674","description":"BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.","status":"published","published":"2011-10-02T02:53:33.79Z","modified":"2026-06-16T23:31:46.42Z","cvss":[{"version":"2.0","score":4.9,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:09.988332Z"}],"osv":[{"id":"GHSA-6wr6-54mw-mvhr","title":"BaserCMS privilege escallation","description":"BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.","status":"published","published":"2022-05-13T01:08:49Z","modified":"2026-09-10T03:49:31.447734027Z","cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}