Cross-site Scripting in Backdrop CMS
Moderate severity
GitHub Reviewed
Published
Apr 24, 2023
to the GitHub Advisory Database
•
Updated Nov 9, 2023
Description
Published by the National Vulnerability Database
Apr 24, 2023
Published to the GitHub Advisory Database
Apr 24, 2023
Reviewed
Apr 24, 2023
Last updated
Nov 9, 2023
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option.
NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."
References