CVE-2024-46995: BaserCMS XSS Vulnerability in HTTP Responses

CVE-2024-46995 Overview

CVE-2024-46995 is a reflected cross-site scripting (XSS) vulnerability in baserCMS, an open-source website development framework maintained by the baserproject. The flaw exists in the handling of HTTP 400 Bad Request responses, where unsanitized user input is reflected back in the error page. An attacker can craft a malicious link that, once visited by a target user, executes attacker-controlled JavaScript in the browser session of the victim. All baserCMS versions prior to 5.1.2 are affected. The maintainers addressed the issue in version 5.1.2. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session theft, credential harvesting, or unauthorized actions within the baserCMS interface.

Affected Products

baserCMS versions prior to 5.1.2
baserproject basercms package distributions
Web applications and sites built on vulnerable baserCMS releases

Discovery Timeline

2024-10-24 - CVE-2024-46995 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-46995

Vulnerability Analysis

The vulnerability is a reflected XSS flaw triggered through the HTTP 400 Bad Request response path in baserCMS. When the framework processes a malformed request, portions of the request data are echoed into the rendered error page without proper output encoding. An attacker who convinces a user to click a crafted URL can inject script content that executes in the victim's browser under the origin of the affected baserCMS site.

Because the payload runs in the site context, the attacker inherits the victim's authentication state. This enables theft of session cookies not marked HttpOnly, forced administrative actions via the baserCMS management console, and delivery of secondary payloads such as phishing overlays. User interaction is required, which lowers exploitation reliability but does not remove risk in publicly reachable deployments.

Root Cause

The root cause is missing or insufficient output encoding when rendering error content in the HTTP 400 handler. Request-derived data reaches the response template without escaping HTML control characters, allowing <script> tags and event handler attributes to survive intact. This maps directly to CWE-79.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL that triggers a Bad Request condition and embeds a JavaScript payload in the reflected parameter. The attacker delivers the link through email, chat, or a malicious page. When a target — often an authenticated baserCMS administrator — visits the URL, the browser executes the payload against the baserCMS origin. See the GitHub Security Advisory GHSA-mr7q-fv7j-jcgv and the baserCMS advisory JVN_06274755 for vendor-confirmed technical details.

No verified public proof-of-concept code is available for this issue, so a runnable exploitation sample is not included here.

Detection Methods for CVE-2024-46995

Indicators of Compromise

HTTP requests to baserCMS endpoints containing script fragments such as <script>, onerror=, or javascript: in query parameters or path segments.
Web server logs showing 400 status responses correlated with unusual URL-encoded payloads targeting the same client IP.
Outbound browser requests from administrator workstations to attacker-controlled domains immediately after visiting a baserCMS URL.

Detection Strategies

Inspect access logs for malformed requests that return HTTP 400 and contain HTML or JavaScript syntax in request data.
Deploy web application firewall (WAF) rules that identify reflected XSS patterns in requests reaching /basercms/ paths.
Monitor for anomalous administrative actions performed shortly after an administrator loads a URL sourced from external referrers.

Monitoring Recommendations

Enable verbose HTTP access logging on the baserCMS host and forward logs to a centralized analytics platform for query and correlation.
Track the installed baserCMS version across managed sites and alert on any host running a release earlier than 5.1.2.
Alert on Content Security Policy (CSP) violation reports that indicate inline script execution against the baserCMS origin.

How to Mitigate CVE-2024-46995

Immediate Actions Required

Upgrade all baserCMS installations to version 5.1.2 or later without delay.
Invalidate active administrator sessions and rotate credentials after patching to remove any residual attacker foothold.
Review recent 400-response log entries for evidence of exploitation attempts against production sites.

Patch Information

The baserCMS maintainers released version 5.1.2 to fix CVE-2024-46995. The patch adds proper output encoding to the HTTP 400 Bad Request response path so that request-derived data is no longer rendered as executable markup. Upgrade instructions and release notes are published in the baserCMS Security Advisory JVN_06274755 and the GitHub Security Advisory GHSA-mr7q-fv7j-jcgv.

Workarounds

Place a WAF or reverse proxy in front of baserCMS to strip or reject requests containing HTML and script metacharacters in query strings.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict access to the baserCMS administrative interface by source IP address until the upgrade is complete.

bash

# Configuration example: sample CSP header to reduce reflected XSS impact
# Apply on the web server fronting baserCMS (e.g., Nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "SAMEORIGIN";