Vulnerability Details CVE-2019-19903
An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying file type descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when viewing the list of file types, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the "Administer file types" permission.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 60.8%
CVSS Severity
CVSS v3 Score 4.8
CVSS v2 Score 3.5
References
Products affected by CVE-2019-19903
-
cpe:2.3:a:backdropcms:backdrop_cms:1.13.0
-
cpe:2.3:a:backdropcms:backdrop_cms:1.13.1
-
cpe:2.3:a:backdropcms:backdrop_cms:1.13.2
-
cpe:2.3:a:backdropcms:backdrop_cms:1.13.3
-
cpe:2.3:a:backdropcms:backdrop_cms:1.13.4
-
cpe:2.3:a:backdropcms:backdrop_cms:1.14.0
-
cpe:2.3:a:backdropcms:backdrop_cms:1.14.1