CVE-2022-42094: Cross-site Scripting in Backdrop CMS
Summary
CVE-2022-42094: Cross-site Scripting in Backdrop CMS. Affects backdrop/backdrop versions < 1.23.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Backdrop CMS is an open-source content management system that allows users to build and manage websites. It provides a range of features and functionalities, including content creation, user management, and theme customization. However, version 1.23.0 of Backdrop CMS is vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability can be exploited through the 'Card' content, potentially allowing an attacker to inject malicious scripts into the website and execute them in the context of the user's browser.
Vulnerability Detail
The stored XSS vulnerability in Backdrop CMS version 1.23.0 allows an attacker to inject malicious scripts into the 'Card' content. When a user views the affected content, the injected scripts are executed in their browser, potentially leading to unauthorized actions, data theft, or further exploitation. This vulnerability has a CVSS score of 4.8, indicating a moderate severity level. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-79.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
Backdrop CMS version 1.23.0 is vulnerable to a stored XSS attack via the 'Card' content. To mitigate this vulnerability, users should update their installations to a patched version and ensure proper sanitization of user-generated content. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for backdrop/backdrop →
FAQ
Backdrop CMS is an open-source content management system that allows users to build and manage websites. It provides a range of features and functionalities, including content creation, user management, and theme customization.
A stored XSS vulnerability occurs when an application allows user-supplied data to be stored and later displayed on web pages without proper sanitization. This can enable attackers to inject malicious scripts into the application, which are then executed in the context of other users' browsers.
The stored XSS vulnerability in Backdrop CMS version 1.23.0 can be exploited by injecting malicious scripts into the 'Card' content. When a user views the affected content, the injected scripts are executed in their browser, potentially leading to unauthorized actions, data theft, or further exploitation.
This vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
To protect your Backdrop CMS installation, it is recommended to upgrade to a patched version that addresses the XSS vulnerability. Additionally, review and sanitize user-generated content to prevent the introduction of malicious scripts.
Related vulnerabilities
Recent vulnerabilities recorded for backdrop/backdrop.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
