CVE-2019-19901

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when configuring a layout, aka XSS. This issue is mitigated by the fact that the attacker would be required to have the permission to create custom blocks, which is typically an administrative task.

CVSS v3 4.8 MEDIUM
CVSS v2.0 3.5 LOW

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://backdropcms.org/security/backdrop-sa-core-2019-013	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:backdropcms:backdrop_cms::::::::
	cpe:2.3:a:backdropcms:backdrop_cms::::::::

History

No history.

Information

Published : 2019-12-19 06:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-19901

Mitre link : CVE-2019-19901

CVE.ORG link : CVE-2019-19901

JSON object : View

Products Affected

backdropcms

backdrop_cms

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2019-19901", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2019-12-19T06:15:11.053", "references": [{"url": "https://backdropcms.org/security/backdrop-sa-core-2019-013", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when configuring a layout, aka XSS. This issue is mitigated by the fact that the attacker would be required to have the permission to create custom blocks, which is typically an administrative task."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Backdrop CMS versiones 1.13.x anteriores a 1.13.5 y versiones 1.14.x anteriores a 1.14.2. No filtra suficientemente la salida cuando se despliegan ciertas descripciones de bloque creadas por parte de los administradores. Un atacante podr\u00eda crear potencialmente una descripci\u00f3n especializada y luego hacer que un administrador ejecute secuencias de comandos al configurar un dise\u00f1o, tambi\u00e9n se conoce como un XSS. Este problema es mitigado por el hecho de que el atacante deber\u00eda tener permiso para crear bloques personalizados, que generalmente es una tarea administrativa."}], "lastModified": "2019-12-27T16:49:32.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC70009E-573A-4607-B4F5-D8C8D4C23B98", "versionEndExcluding": "1.13.5", "versionStartIncluding": "1.13.0"}, {"criteria": "cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA7553B9-C72A-4305-8E42-D816D77F27D8", "versionEndExcluding": "1.14.2", "versionStartIncluding": "1.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}