Cross-site Scripting in Backdrop CMS
The advisory, in context
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option.
NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 1.24.2
Fixed in 1.24.2
12 explicitly affected versions
1.13.2-rc1, 1.13.2-rc2, 1.17.3, 1.18.3, 1.19.1, 1.20.3, 1.21.0, 1.21.1, 1.21.3, 1.21.4, 1.22.1, 1.22.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.13.2-rc1",
"1.13.2-rc2",
"1.17.3",
"1.18.3",
"1.19.1",
"1.20.3",
"1.21.0",
"1.21.1",
"1.21.3",
"1.21.4",
"1.22.1",
"1.22.2"
]
}