PT-2019-15997 · Backdrop · Backdrop Cms

Bot Kotatu · Publicado 2019-12-19 · Atualizado 2019-12-27 · CVE-2019-19903

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Backdrop CMS versions 1.14.x through 1.14.1

Description An issue was discovered where the software does not sufficiently filter output when displaying file type descriptions created by administrators. This could allow an attacker to craft a specialized description and have an administrator execute scripting when viewing the list of file types. The issue is mitigated by the requirement that an attacker must have a role with the "Administer file types" permission.

Recommendations For Backdrop CMS versions 1.14.x through 1.14.1, update to version 1.14.2 or later to resolve the issue. As a temporary workaround, consider restricting the "Administer file types" permission to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-19903

Produtos afetados

Backdrop Cms

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-19903 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19903 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-19903 · Nota de Segurança
• https://backdropcms.org/security/backdrop-sa-core-2019-015 · Aviso do Fabricante