CVE Vulnerability

CVE-2019-19900

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names in the content creation interface. An attacker could potentially craft a specialized content type name, then have an editor execute scripting when creating content, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the "Administer content types" permission.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

4.8 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://backdropcms.org/security/backdrop-sa-core-2019-014 Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:*
Information

Published : 2019-12-19 06:15

Updated : 2019-12-27 05:16

NVD link : CVE-2019-19900

Mitre link : CVE-2019-19900

Products Affected
No products.
CWE
CWE-79