- Cross Site Scripting
- Third Party Libraries
- Backdrop Core 1.20.x versions prior to 1.20.2
- Backdrop Core 1.19.x versions prior to 1.19.5
Backdrop versions 1.18 and prior do not receive security coverage.
Vulnerabilities are possible if Backdrop is configured to allow use of the CKEditor library for Rich-Text editing. An attacker that can create or edit content (even without access to the Editor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target other people who do have access to the Rich-Text Editor, including site admins with privileged access.
For more information, see CKEditor's security advisories.
- Jacek Bogdański coordinated on the release with Drupal project.
- See the CKEditor announcements above for the original reporters of the vulnerabilities.