CVE-2022-42092: Backdrop CMS Unrestricted File Upload vulnerability
Summary
CVE-2022-42092: Backdrop CMS Unrestricted File Upload vulnerability. Affects backdrop/backdrop versions < 1.22.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Backdrop CMS is an open-source content management system that allows users to build and manage websites. It provides a range of features and functionalities, including theme customization. However, version 1.22.0 of Backdrop CMS is vulnerable to an Unrestricted File Upload issue in the 'themes' component. This vulnerability can be exploited by attackers to achieve Remote Code Execution.
Vulnerability Detail
The Unrestricted File Upload vulnerability in Backdrop CMS 1.22.0 allows attackers to upload malicious files through the 'themes' feature. By exploiting this vulnerability, an attacker can execute arbitrary code on the affected system, potentially leading to further compromise and unauthorized access. This vulnerability is rated as HIGH severity with a CVSS score of 7.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the 'themes' functionality in Backdrop CMS until the patch is applied. This can be done by modifying the configuration or permissions to restrict file uploads in the 'themes' directory. However, this workaround may impact the functionality and customization options provided by the 'themes' feature.
Conclusion
Backdrop CMS version 1.22.0 is vulnerable to an Unrestricted File Upload issue in the 'themes' component, which can lead to Remote Code Execution. Users are advised to upgrade to a patched version of Backdrop CMS and review any uploaded files for safety. Disabling the 'themes' functionality can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for backdrop/backdrop →
FAQ
Backdrop CMS is an open-source content management system used for building and managing websites.
The vulnerability allows attackers to upload malicious files and execute arbitrary code on the affected system, potentially leading to further compromise and unauthorized access.
To fix this vulnerability, it is recommended to upgrade to a patched version of Backdrop CMS. Users should update their installations to the latest version available.
Yes, as a temporary workaround, users can disable the 'themes' functionality in Backdrop CMS until the patch is applied. This can be done by modifying the configuration or permissions to restrict file uploads in the 'themes' directory.
Yes, the CVSS score for this vulnerability is 7.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for backdrop/backdrop.
