- Cross Site Scripting
- Cross Site Request Forgery
- SQL Injection
- Information Disclosure
- Multiple vulnerabilities
- Backdrop Core 1.x.x versions prior to 1.1.3
XSS injection in AJAX Framework
A vulnerability was found that allows a malicious user to perform an XSS attack by invoking Backdrop.ajax() on a whitelisted HTML element. This vulnerability is mitigated on sites that do not allow untrusted users to enter HTML.
XSS injection in Autocomplete
A cross-site scripting vulnerability was found in the autocomplete functionality of forms. The requested URL is not sufficiently sanitized. This vulnerability is mitigated by the fact that the malicious user must be allowed to upload files to the site.
SQL Injection
A vulnerability was found in the SQL comment filtering system which could allow a user with elevated permissions to inject malicious code in SQL comments. This vulnerability is mitigated by only be accessible to users with "administer views" permissions.
Value callbacks in Form API might run with untrusted input
A vulnerability was discovered in Backdrop's Form API that could allow file upload value callbacks to run with untrusted input, due to the order form token not being checked early enough. This vulnerability can be mitigated by not allowing untrusted users to upload files.
Information Disclosure of Node Titles in Menu Links
For a site that has removed the "access content" permission from anonymous users, the titles of nodes that are added to the main menu or another menu are still visible to anonymous users. This vulnerability is mitigated by the fact the site administrators must have added one or more nodes to a menu that is visible to anonymous users, and the site must not be using a node access module that would filter the nodes out from content listings for anonymous users.
Upgrade your site to the latest version of Backdrop CMS. Download available at Backdrop CMS 1.1.3 release page. Update instructions are available at https://backdropcms.org/upgrade#from-previous-versions.
XSS injection in AJAX Framework:
- Régis Leroy
- Kay Leung, Drupal core JavaScript maintainer
- Samuel Mortenson
- Pere Orga of the Drupal Security Team
XSS injection in Autocomplete:
- Alex Bronstein of the Drupal Security Team
- Pere Orga of the Drupal Security Team
SQL Injection:
- Carl Sabottke of White Fir Design LLC
Value callbacks in Form API might run with untrusted input:
Information Disclosure of Node Titles in Menu Links:
- David_Rothstein of the Drupal Security Team
XSS injection in AJAX Framework:
- Théodore Biadala, Drupal core JavaScript maintainer
- Alex Bronstein of the Drupal Security Team
- Ben Dougherty of the Drupal Security Team
- Gábor Hojtsy of the Drupal Security Team
- Greg Knaddison of the Drupal Security Team
- Kay Leung, Drupal core JavaScript maintainer
- Wim Leers
- Samuel Mortenson
- Pere Orga of the Drupal Security Team
- Tim Plunkett
- David Rothstein of the Drupal Security Team
- Lee Rowlands of the Drupal Security Team
- Peter Wolanin of the Drupal Security Team
- znerol, maintainer of Authcache module
- Nate Haug of the Backdrop CMS Security Team
XSS injection in Autocomplete:
- Alex Bronstein of the Drupal Security Team
- Lee Rowlands of the Drupal Security Team
- Peter Wolanin of the Drupal Security Team
- David Rothstein of the Drupal Security Team
- Nate Haug of the Backdrop CMS Security Team
SQL Injection:
- Anthony Ferrara
- Larry Garfield
- Greg Knaddison of the Drupal Security Team
- David Rothstein of the Drupal Security Team
- Cathy Theys
- Peter Wolanin of the Drupal Security Team
Value callbacks in Form API might run with untrusted input:
- Greg Knaddison of the Drupal Security Team
- Wim Leers
- David Rothstein of the Drupal Security Team
- Lee Rowlands of the Drupal Security Team
- Peter Wolanin of the Drupal Security Team
Information Disclosure of Node Titles in Menu Links:
- David_Rothstein of the Drupal Security Team
- Nate Haug of the Backdrop CMS Security Team
- David_Rothstein of the Drupal Security Team