CVE-2022-42097: Cross-site Scripting in Backdrop CMS
Summary
CVE-2022-42097: Cross-site Scripting in Backdrop CMS. Affects backdrop/backdrop versions < 1.23.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Backdrop CMS is an open-source content management system that provides a user-friendly interface for creating and managing websites. It is built on top of the Drupal framework and offers a range of features and modules for customization. However, version 1.23.0 of Backdrop CMS has been found to have a stored cross-site scripting (XSS) vulnerability in the 'Comment' functionality.
Vulnerability Detail
The stored XSS vulnerability in Backdrop CMS version 1.23.0 allows an attacker to inject malicious scripts into the 'Comment' field, which is then stored and displayed on the website. This can lead to the execution of arbitrary code in the context of the user's browser, potentially compromising user data or enabling further attacks. The vulnerability has a moderate severity rating (CWE-79) and was published on November 22, 2022.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the 'Comment' functionality in Backdrop CMS until the patch is applied. This can be done by modifying the configuration or disabling the related module. However, this may impact the functionality of the website and should only be considered as a temporary measure.
Conclusion
Backdrop CMS version 1.23.0 has been found to have a stored cross-site scripting (XSS) vulnerability in the 'Comment' functionality. Users are advised to upgrade to a patched version of Backdrop CMS to mitigate this vulnerability. In the meantime, a temporary workaround is available by disabling the 'Comment' functionality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for backdrop/backdrop →
FAQ
Backdrop CMS is an open-source content management system based on the Drupal framework. It provides a user-friendly interface for creating and managing websites.
A stored XSS vulnerability allows an attacker to inject malicious scripts into a website, which are then stored and displayed to other users. This can lead to the execution of arbitrary code in the context of the user's browser.
This vulnerability has a moderate severity rating (CWE-79), indicating a potential impact on the confidentiality, integrity, and availability of user data.
To fix this vulnerability, it is recommended to upgrade to a patched version of Backdrop CMS. The developers have released a fix in a subsequent version, which addresses the XSS vulnerability.
Yes, as a temporary workaround, users can disable the 'Comment' functionality in Backdrop CMS until the patch is applied. This can be done by modifying the configuration or disabling the related module.
Related vulnerabilities
Recent vulnerabilities recorded for backdrop/backdrop.
