Cross-Site Scripting Vulnerability in Backdrop CMS by Backdrop
CVE-2019-19900

4.8MEDIUM

Key Information:

Vendor

Backdropcms

Status
Backdrop Cms
Vendor
CVE Published:
19 December 2019

What is CVE-2019-19900?

A Cross-Site Scripting vulnerability exists in Backdrop CMS versions 1.13.x prior to 1.13.5 and 1.14.x prior to 1.14.2. This issue arises from insufficient output filtering of content type names within the content creation interface. Malicious actors could exploit this vulnerability by crafting a specially designed content type name that may lead to script execution by an editor during content creation. While an attacker needs to have a role with the 'Administer content types' permission to trigger this vulnerability, it highlights the importance of stringent input validation and output encoding to ensure web application security.

References

https://backdropcms.org/security/backdrop-sa-core-2019-014
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2019-19900 : Cross-Site Scripting Vulnerability in Backdrop CMS by Backdrop