PT-2019-15994 · Backdrop · Backdrop Cms

Bot Kotatu · Publicado 2019-12-19 · Atualizado 2019-12-27 · CVE-2019-19900

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Backdrop CMS versions 1.13.x through 1.13.4 Backdrop CMS versions 1.14.x through 1.14.1

Description An issue was discovered that allows for potential XSS attacks when displaying content type names in the content creation interface. The software does not sufficiently filter output, which could be exploited by an attacker crafting a specialized content type name to execute scripting when an editor creates content. This issue is mitigated by the requirement that an attacker must have a role with the "Administer content types" permission.

Recommendations For Backdrop CMS versions 1.13.x through 1.13.4, update to version 1.13.5 or later. For Backdrop CMS versions 1.14.x through 1.14.1, update to version 1.14.2 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-19900

Produtos afetados

Backdrop Cms

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-19900 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19900 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-19900 · Nota de Segurança
• https://backdropcms.org/security/backdrop-sa-core-2019-014 · Aviso do Fabricante