Vulnerability Description
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. An attacker could potentially craft a specialized label, then have an administrator execute scripting when administering a layout. (This issue is mitigated by the attacker needing permission to create custom blocks on the site, which is typically an administrative permission.)
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Backdropcms | Backdrop | >= 1.12.0, < 1.12.8 |
Related Weaknesses (CWE)
References
- https://backdropcms.org/security/backdrop-sa-core-2019-011Vendor Advisory
- https://backdropcms.org/security/backdrop-sa-core-2019-011Vendor Advisory
FAQ
What is CVE-2019-14769?
CVE-2019-14769 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. An attacker could potentially craft a spec...
How severe is CVE-2019-14769?
CVE-2019-14769 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-14769?
Check the references section above for vendor advisories and patch information. Affected products include: Backdropcms Backdrop.