Date:
Wednesday, Feb 21st, 2018
Advisory ID:
BACKDROP-SA-CORE-2018-001c
Security risk:
Less Critical
Vulnerability:
Cross Site Scripting
CVE ID:
Versions affected:
- Backdrop Core versions prior to 1.9.2
Description:
Backdrop core has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site.
Solution:
Upgrade your site to the most recent version of Backdrop core. Download available on the Backdrop CMS 1.9.2 release page. See the update instructions, if needed.
Reported By:
- David Rothstein of the Drupal Security Team
Fixed By:
- David Rothstein of the Drupal Security Team
- Samuel Mortenson
- Nate Lampton of the Backdrop Security Team
Coordinated By:
- Jess of the Drupal Security Team
- Michael Hess of the Drupal Security Team
- Nate Lampton of the Backdrop Security Team