CVE Vulnerability

CVE-2019-19903

An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying file type descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when viewing the list of file types, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the "Administer file types" permission.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

4.8 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://backdropcms.org/security/backdrop-sa-core-2019-015 Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:*
Information

Published : 2019-12-19 06:15

Updated : 2019-12-27 04:39

NVD link : CVE-2019-19903

Mitre link : CVE-2019-19903

Products Affected
No products.
CWE
CWE-79