PT-2022-7075 · Unknown · Backdrop Cms

Grim The Ripper Team · Published 2022-09-27 · Updated 2022-11-23 · CVE-2022-42096

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Backdrop CMS version 1.23.0

Description The issue is related to a stored cross-site scripting (XSS) vulnerability in Backdrop CMS. This vulnerability can be exploited via Post content, allowing a remote attacker to conduct cross-site scripting attacks. The account must have admin privileges to exploit this vulnerability.

Recommendations For Backdrop CMS version 1.23.0, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Post content feature to minimize the risk of exploitation. Additionally, ensure that admin privileges are strictly controlled and monitored to prevent potential attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07500

CVE-2022-42096

GHSA-G8JW-8VPV-PV5Q

Affected Products

Backdrop Cms

References · 11

• 🔥 https://github.com/bypazs/CVE-2022-42096 · Exploit
• 🔥 https://grimthereaperteam.medium.com/cve-2022-42096-backdrop-xss-at-posts-437c305036e2 · Exploit
• https://osv.dev/vulnerability/GHSA-g8jw-8vpv-pv5q · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07500 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-42096 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42096 · Vendor Advisory
• https://github.com/backdrop/backdrop/releases · Note
• https://github.com/backdrop/backdrop/releases/tag/1.23.0 · Note
• https://backdropcms.org · Note
• https://t.me/cvenotify/38169 · Telegram Post
• https://t.me/cibsecurity/53287 · Telegram Post