CVE-2024-41709: Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.
Other sources
Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/backdrop/backdropto a version that resolves this vulnerability.Fixed in 1.28.2 - Upgrade
Upgrade
composer/backdrop/backdropto a version that resolves this vulnerability.Fixed in 1.27.3 - Upgrade
Upgrade
Backdrop CMSto a version that resolves this vulnerability.Fixed in 1.27.3 - Upgrade
Upgrade
Backdrop CMSto a version that resolves this vulnerability.Fixed in 1.28.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41709?
CVE-2024-41709 has a moderate severity due to improper sanitization of field labels which can lead to potential exposure of sensitive information.
How do I fix CVE-2024-41709?
To resolve CVE-2024-41709, upgrade your Backdrop CMS version to 1.27.3 or 1.28.2.
Who is affected by CVE-2024-41709?
CVE-2024-41709 affects users of Backdrop CMS versions prior to 1.27.3 and versions between 1.28.0 and 1.28.1.
What impact does CVE-2024-41709 have on my Backdrop CMS site?
The vulnerability can allow attackers with administrative field permissions to display unsanitized field labels, leading to potential XSS attacks.
Is my role in Backdrop CMS relevant to CVE-2024-41709?
Yes, an attacker must have the 'administer fields' permission to exploit CVE-2024-41709.