CSRF Vulnerability in Backdrop CMS Allows Remote Code Execution
CVE-2021-45268

8.8HIGH

Key Information:

Vendor

Backdropcms

Status
Backdrop
Vendor
CVE Published:
3 February 2022

What is CVE-2021-45268?

A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, allowing remote attackers to potentially execute arbitrary code on the hosting web server. This can be achieved by uploading a malicious add-on containing a crafted PHP file, but the attack necessitates a session cookie from a high-privileged authenticated user who has the capability to install arbitrary add-ons. The vendor has expressed disagreement with the severity of this issue, emphasizing the need for appropriate user privileges.

References

https://www.exploit-db.com/exploits/50323
x_refsource_MISC
https://github.com/V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2021-45268 : CSRF Vulnerability in Backdrop CMS Allows Remote Code Execution