GitHub Advisoryadvisory · Packagist

GHSA-3wmx-48g3-x66g Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places

MEDIUM Published 2024-07-22 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-41709
Ecosystem
Packagist
Packages
backdrop/backdrop
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-07-25

Affected packages

• Packagist backdrop/backdrop: < 1.27.3 → fixed in 1.27.3 • Packagist backdrop/backdrop: >= 1.28.0, < 1.28.2 → fixed in 1.28.2

Description

Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.

Related

Alias · CVE (1)

  • CVE-2024-41709 Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References