GHSA-3wmx-48g3-x66g
Suggest an improvement- Source
- https://github.com/advisories/GHSA-3wmx-48g3-x66g
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-3wmx-48g3-x66g/GHSA-3wmx-48g3-x66g.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-3wmx-48g3-x66g
- Aliases
- Published
- 2024-07-22T06:31:08Z
- Modified
- 2024-07-25T18:26:55.694986Z
- Severity
-
- 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- 4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places
- Details
-
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2024-41709
- https://github.com/backdrop/backdrop/commit/c7ff0500705668e3f58263590812872e44059301
- https://github.com/backdrop/backdrop/commit/f1dfe710c186fb47c9d949f01f37e5ab42b44030
- https://backdropcms.org/security/backdrop-sa-core-2024-001
- https://github.com/backdrop-ops/backdrop-composer
Affected packages
Packagist / backdrop/backdrop
Package
- Name
- backdrop/backdrop
- Purl
- pkg:composer/backdrop/backdrop
Packagist / backdrop/backdrop
Package
- Name
- backdrop/backdrop
- Purl
- pkg:composer/backdrop/backdrop