CVE-2024-41709: XSS
First published: Mon Jul 22 2024(Updated: )
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/backdrop/backdrop | >=1.28.0<1.28.2 | 1.28.2 |
| composer/backdrop/backdrop | <1.27.3 | 1.27.3 |
| Backdrop | >=1.27.0<1.27.3 | |
| Backdrop | >=1.28.0<1.28.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://backdropcms.org/security/backdrop-sa-core-2024-001
- https://nvd.nist.gov/vuln/detail/CVE-2024-41709
- https://github.com/backdrop/backdrop/commit/c7ff0500705668e3f58263590812872e44059301
- https://github.com/backdrop/backdrop/commit/f1dfe710c186fb47c9d949f01f37e5ab42b44030
- https://github.com/advisories/GHSA-3wmx-48g3-x66g (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-41709?
CVE-2024-41709 has a moderate severity due to improper sanitization of field labels which can lead to potential exposure of sensitive information.
How do I fix CVE-2024-41709?
To resolve CVE-2024-41709, upgrade your Backdrop CMS version to 1.27.3 or 1.28.2.
Who is affected by CVE-2024-41709?
CVE-2024-41709 affects users of Backdrop CMS versions prior to 1.27.3 and versions between 1.28.0 and 1.28.1.
What impact does CVE-2024-41709 have on my Backdrop CMS site?
The vulnerability can allow attackers with administrative field permissions to display unsanitized field labels, leading to potential XSS attacks.
Is my role in Backdrop CMS relevant to CVE-2024-41709?
Yes, an attacker must have the 'administer fields' permission to exploit CVE-2024-41709.
- agent/description
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/references
- agent/severity
- agent/event
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3wmx-48g3-x66g
- alias/CVE-2024-41709
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/github-advisory
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- package-manager/composer
- vendor/backdropcms
- canonical/backdrop
- version/backdrop/1.27.0
- version/backdrop/1.28.0