CVE-2018-0575 Sensitive Data Exposure in baserCMS
Remote attackers can bypass access restrictions in the mail form to view files uploaded by site users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-0575?
CVE-2018-0575 is a medium-severity vulnerability in Basercms Basercms, published on 26 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors.
Weakness: CWE-200
Which versions are affected by CVE-2018-0575?
4 open source packages ship an affected version, including baserproject/basercms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
baserproject/basercms Packagist | All versions to 3.0.15 | None |
baserproject/basercms Packagist | All versions to 3.0.15 | None |
baserproject/basercms Packagist | From 4.0.0 to 4.1.0.1 | None |
baserproject/basercms Packagist | From 4.0.0 to 4.1.0.1 | None |
Products include Basercms Basercms.
How do I fix CVE-2018-0575?
No fix has been published for CVE-2018-0575 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-0575 being exploited?
There is no known exploitation of CVE-2018-0575 in the wild and no public exploit code.
Other vulnerabilities in Basercms Basercms
- CVE-2023-25654 baserCMS File Uploader Remote Code Execution (RCE) vulnerability
- CVE-2023-25655 baserCMS allows any file to be uploaded
- CVE-2017-10842 baserCMS SQL Injection vulnerability
- CVE-2026-30880 baserCMS: OS command injection vulnerability in installer
- CVE-2026-21861 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)
Sources
Also known as GHSA-w935-p7mg-xc96.