Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-41709US | medium4.8 | — | ||
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the… | ||||
02
references
External citations — patches, advisories, analysis.
- https://backdropcms.org/security/backdrop-sa-core-2024-001WEB
- https://github.com/backdrop-ops/backdrop-composerPACKAGE
- https://github.com/backdrop/backdrop/commit/c7ff0500705668e3f58263590812872e44059301WEB
- https://github.com/backdrop/backdrop/commit/f1dfe710c186fb47c9d949f01f37e5ab42b44030WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-41709ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan