PT-2022-7183 · Unknown · Backdrop Cms

Grim The Ripper Team · Published 2022-11-22 · Updated 2025-04-29 · CVE-2022-42094

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:M/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Backdrop CMS version 1.23.0

Description The issue is related to the lack of protection for the web page structure in Backdrop CMS, which can be exploited by a remote attacker to conduct cross-site scripting (XSS) attacks. Specifically, the vulnerability is a stored XSS via the Card content.

Recommendations For Backdrop CMS version 1.23.0, consider disabling the Card content feature until a patch is available to prevent exploitation of the stored XSS vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08739

CVE-2022-42094

GHSA-VCVG-G8P2-3HQR

Affected Products

Backdrop Cms

References · 11

• 🔥 https://github.com/bypazs/CVE-2022-42094 · Exploit
• 🔥 https://grimthereaperteam.medium.com/cve-2022-42094-backdrop-xss-at-cards-84266b5250f1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-42094 · Security Note
• https://bdu.fstec.ru/vul/2023-08739 · Security Note
• https://backdropcms.org · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vcvg-g8p2-3hqr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-42094 · Vendor Advisory
• https://github.com/backdrop/backdrop/releases/tag/1.23.0 · Note
• https://t.me/cvenotify/120195 · Telegram Post
• https://vuldb.com/?id.211890 · Note
• https://t.me/cibsecurity/53337 · Telegram Post