A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."
References
| Link | Resource |
|---|---|
| https://github.com/backdrop/backdrop-issues/issues/6065 | Exploit Issue Tracking Vendor Advisory |
| https://github.com/backdrop/backdrop/releases/tag/1.24.2 | Release Notes |
| https://github.com/backdrop/backdrop-issues/issues/6065 | Exploit Issue Tracking Vendor Advisory |
| https://github.com/backdrop/backdrop/releases/tag/1.24.2 | Release Notes |
Configurations
History
21 Nov 2024, 08:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/backdrop/backdrop-issues/issues/6065 - Exploit, Issue Tracking, Vendor Advisory | |
| References | () https://github.com/backdrop/backdrop/releases/tag/1.24.2 - Release Notes |
07 Nov 2023, 04:14
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere." |
Information
Published : 2023-04-24 08:15
Updated : 2024-11-21 08:01
NVD link : CVE-2023-31045
Mitre link : CVE-2023-31045
CVE.ORG link : CVE-2023-31045
JSON object : View
Products Affected
backdropcms
- backdrop
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')