XSS in Backdropcms Backdrop Core
CVE-2019-14770
In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the administrator is logged in and uses the search functionality. (This issue is mitigated by the attacker needing permissions to create administrative menu links, such as by creating a content type or layout. Such permissions are usually restricted to trusted or administrative users.)
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.008 (52.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Backdropcms Backdrop_core
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-14770?
- CVE-2019-14770 is a medium-severity vulnerability in Backdropcms Backdrop Core, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2019-08-08.
- How severe is CVE-2019-14770?
- Medium severity. CVSS v3 base score is 6.1 out of 10.