VulnerabilityModified

CVE-2023-26265

The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL.

MEDIUM 5.3EPSS 0.58%

Does this matter?

Lower severity and a low EPSS score (0.58%). Track it; it rarely justifies an emergency change on its own.

Description

The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL. The function borg_preprocess_page in the file template.php does not properly sanitize incoming path arguments before using them.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.58% probability · 46th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: borg project/borg
Source: cve@mitre.org

References

https://backdropcms.org/project/borgProduct
https://github.com/backdrop-contrib/borg/compare/1.x-1.1.18...1.x-1.1.19Patch
https://backdropcms.org/project/borgProduct
https://github.com/backdrop-contrib/borg/compare/1.x-1.1.18...1.x-1.1.19Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.