Cross-Site Scripting in Backdrop CMS by Backdrop

CVE-2019-19901

What is CVE-2019-19901?

A security issue in Backdrop CMS allows for Cross-Site Scripting (XSS) attacks due to insufficient output filtering of block descriptions created by administrators. This vulnerability affects versions prior to 1.13.5 and 1.14.2, where an attacker with permission to create custom blocks can exploit the flaw by crafting a malicious block description. When an administrator configures the layout, the attacker's script could execute, potentially compromising the web application.

References