Lucene search

[email protected]NVD:CVE-2022-42094

HistoryNov 22, 2022 - 1:15 p.m.

CVE-2022-42094

2022-11-2213:15:14

CWE-79

[email protected]

web.nvd.nist.gov

backdrop cms

xss vulnerability

card content

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.007

Percentile

80.5%

JSON

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the ‘Card’ content.

Affected configurations

Nvd

Node

backdropcmsbackdropMatch1.23.0

VendorProductVersionCPE
backdropcmsbackdrop1.23.0cpe:2.3:a:backdropcms:backdrop:1.23.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
backdropcms	backdrop	1.23.0	cpe:2.3:a:backdropcms:backdrop:1.23.0:::::::*

References

backdropcms.org

github.com/backdrop/backdrop/releases/tag/1.23.0

github.com/bypazs/CVE-2022-42094

grimthereaperteam.medium.com/cve-2022-42094-backdrop-xss-at-cards-84266b5250f1