GitHub Advisoryadvisory · Packagist

GHSA-3862-c622-v4fp Cross-site Scripting in Backdrop CMS

MEDIUM Published 2023-04-24 Modified 2024-08-02 Official page ↗
Aliases
CVE-2023-31045
Ecosystem
Packagist
Packages
backdrop/backdrop
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-04-24

Affected packages

• Packagist backdrop/backdrop: < 1.24.2 → fixed in 1.24.2

Description

A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."

Related

Alias · CVE (1)

  • CVE-2023-31045 A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References