CVE-2023-31045

MEDIUM EPSS 41.1%
Published Apr 24, 20233y ago · Modified Jun 17, 20261w ago
4.8 CVSS 3.1
Medium
Find Similar
Published Apr 24, 2023 3y ago
Last Modified Jun 17, 2026 1w ago

Description

A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."

CVSS Details

Base Score
4.8
Exploitability
1.7
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
41.1% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
backdropcmsbackdrop_cms* <1.24.2

References 2

  • github.com https://github.com/backdrop/backdrop-issues/issues/6065
    ExploitIssue TrackingVendor Advisory
  • github.com https://github.com/backdrop/backdrop/releases/tag/1.24.2
    Release Notes

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.