CVE-2023-31045
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
Does this matter?
Lower severity and a low EPSS score (0.53%). Track it; it rarely justifies an emergency change on its own.
Description
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.53% probability · 43th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- backdropcms/backdrop cms
- Source
- cve@mitre.org
References
- https://github.com/backdrop/backdrop-issues/issues/6065Exploit, Issue Tracking, Vendor Advisory
- https://github.com/backdrop/backdrop/releases/tag/1.24.2Release Notes
- https://github.com/backdrop/backdrop-issues/issues/6065Exploit, Issue Tracking, Vendor Advisory
- https://github.com/backdrop/backdrop/releases/tag/1.24.2Release Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.