CVE-2015-5640 baserCMS Access Control Bypass
Authenticated users can modify arbitrary user settings in baserCMS due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-5640?
CVE-2015-5640 is a medium-severity missing authorization vulnerability in Basercms Basercms, published on 3 Oct 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request.
Weakness: CWE-264
Which versions are affected by CVE-2015-5640?
2 open source packages ship an affected version, including baserproject/basercms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
baserproject/basercms Packagist | All versions | 3.0.8 |
baserproject/basercms Packagist | All versions | 3.0.8 |
Products include Basercms Basercms.
How do I fix CVE-2015-5640?
Upgrade baserproject/basercms to 3.0.8 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2015-5640 being exploited?
There is no known exploitation of CVE-2015-5640 in the wild and no public exploit code.
Other vulnerabilities in Basercms Basercms
- CVE-2023-25654 baserCMS File Uploader Remote Code Execution (RCE) vulnerability
- CVE-2023-25655 baserCMS allows any file to be uploaded
- CVE-2017-10842 baserCMS SQL Injection vulnerability
- CVE-2026-30880 baserCMS: OS command injection vulnerability in installer
- CVE-2026-21861 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)
Sources
Also known as GHSA-v9gf-98vr-mgp2.