Stored Cross-site Scripting Vulnerability in Backdrop CMS by Backdrop
CVE-2023-31045

4.8MEDIUM

Key Information:

Vendor

Backdropcms

Status
Backdrop
Vendor
CVE Published:
24 April 2023

What is CVE-2023-31045?

A vulnerability in Backdrop CMS prior to version 1.24.2 allows remote attackers to exploit a stored Cross-site Scripting (XSS) flaw affecting the text editors and formats feature. An attacker can inject arbitrary web scripts or HTML through the 'name' parameter during content type edits. When an administrator selects a user-configured malicious text formatting option, the harmful payload is executed, leading to potential unauthorized actions and data compromise. While the vendor questions the significance of the finding, this vulnerability poses a risk to users relying on secure text formatting configurations.

References

https://github.com/backdrop/backdrop/releases/tag/1.24.2
https://github.com/backdrop/backdrop-issues/issues/6065

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-31045 : Stored Cross-site Scripting Vulnerability in Backdrop CMS by Backdrop