Date:
Wednesday, Mar 2nd, 2022
Advisory ID:
BACKDROP-SA-CORE-2022-002
Security risk:
Moderately Critical
Vulnerability:
Cross Site Scripting
CVE ID:
Versions affected:
- Backdrop Core 1.21.x versions prior to 1.21.3
- Backdrop Core 1.20.x versions prior to 1.20.6
Backdrop versions 1.19 and prior do not receive security coverage.
Description:
Backdrop CMS doesn't sufficiently sanitize certain interface text when adding links to existing content.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to create content (nodes), files, user accounts, taxonomy terms, views, or layouts.
Solution:
Upgrade your site to the most recent version of Backdrop core. Download available on the Backdrop CMS 1.21.3 release page. See the update instructions, if needed.
Reported By:
- This issue was not reported to the Backdrop Security team before the CVE was created.
Fixed By:
- Jen Lampton of the Backdrop CMS Security Team
- Peter Anderson of the Backdrop CMS Security Team
- Nate Lampton of the Backdrop CMS Security Team
Coordinated By:
- Greg Netsas of the Backdrop CMS Security Team
- Nate Lampton of the Backdrop CMS Security Team
- Tim Erickson