CVE-2024-41709: XSS
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41709?
CVE-2024-41709 has a moderate severity due to improper sanitization of field labels which can lead to potential exposure of sensitive information.
How do I fix CVE-2024-41709?
To resolve CVE-2024-41709, upgrade your Backdrop CMS version to 1.27.3 or 1.28.2.
Who is affected by CVE-2024-41709?
CVE-2024-41709 affects users of Backdrop CMS versions prior to 1.27.3 and versions between 1.28.0 and 1.28.1.
What impact does CVE-2024-41709 have on my Backdrop CMS site?
The vulnerability can allow attackers with administrative field permissions to display unsanitized field labels, leading to potential XSS attacks.
Is my role in Backdrop CMS relevant to CVE-2024-41709?
Yes, an attacker must have the 'administer fields' permission to exploit CVE-2024-41709.