CVE Feed

    Dashboard / CVE / CVE-2024-41709

    CVE-2024-41709

    Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.

    Published:Jul 22, 2024
    Last Modified:Mar 21, 2025
    EPS:Jul 22, 2024
    EPSS Score:0.00412
    CVSS Score:6.1

    Affected Products

    Vendor
    Backdropcms
    Product
    Backdrop

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-25063 (CVSS 4.4) — An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not suffici…
    CVE-2022-42094 (CVSS 4.8) — Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via th…
    CVE-2022-42097 (CVSS 4.8) — Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'C…
    CVE-2022-24590 (CVSS 5.4) — A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attac…
    CVE-2021-45268 (CVSS 8.8) — A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers t…
    CVE-2019-14769 (CVSS 6.1) — Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying …
    CVE-2019-11358 (CVSS 6.1) — jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, .…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High