Date:
Wednesday, Dec 18th, 2019
Advisory ID:
BACKDROP-SA-CORE-2019-013
Security risk:
Moderately Critical
Vulnerability:
Cross Site Scripting
CVE ID:
Versions affected:
- Backdrop Core 1.14.x versions prior to 1.14.2
- Backdrop Core 1.13.x versions prior to 1.13.5
Description:
Backdrop CMS doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when configuring a layout.
This issue is mitigated by the fact that the attacker would be required to have the permission to create custom blocks, which is typically an administrative task.
Solution:
Upgrade your site to the most recent version of Backdrop core. Download available on the Backdrop CMS 1.14.2 release page. See the update instructions, if needed.
Reported By:
- Nate Lampton of the Backdrop CMS Security Team
Fixed By:
- Nate Lampton of the Backdrop CMS Security Team
Coordinated By:
- Jen Lampton of the Backdrop CMS Security Team