CVE-2024-41709

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-41709
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41709.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-41709
Aliases
Published
2024-07-22T00:00:00Z
Modified
2026-07-15T01:48:51.766069389Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41709.json",
    "cna_assigner": "mitre",
    "unresolved_ranges": [
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "1.27.3"
                },
                {
                    "introduced": "1.28.x"
                },
                {
                    "fixed": "1.28.2"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/backdrop/backdrop

Affected ranges

Type
GIT
Repo
https://github.com/backdrop/backdrop
Events
Introduced
68e57502fbc8aea3f341c9e43c21d456d7439204
Fixed
c2414f7f3a3f9f143d904e90f1c6b806c1601868
Introduced
cb77a9c8df5dd334ceedd22365bfc021975b9e69
Fixed
82b5dcea3c8860ee9f3fc199387c72113fc55bbf
Database specific 
{
    "cpe": "cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "1.27.0"
        },
        {
            "fixed": "1.27.3"
        },
        {
            "introduced": "1.28.0"
        },
        {
            "fixed": "1.28.2"
        }
    ]
}

Affected versions

1.*
1.27.0
1.27.1
1.27.2
1.28.0
1.28.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41709.json"