CVE-2019-14770
Medium
Description
In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the administrator is logged in and uses the search functionality. (This issue is mitigated by the attacker needing permissions to create administrative menu links, such as by creating a content type or layout. Such permissions are usually restricted to trusted or administrative users.)
SeverityMedium
CVSS6.1
Exploit probability—
ProductBackdropcms Backdrop Core
PublishedAug 8, 2019
First seenAug 8, 2019
How to fix
Update
- backdropcms backdrop_core1.12.8, 1.13.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| backdropcms backdrop_core | 1.12.0 ≤ v < 1.12.8, 1.13.0 ≤ v < 1.13.3 | 1.12.8, 1.13.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.