CVE-2024-41709: Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability…

PriorityP420medium4.8CVSS 3.1

AVNACLPRHUIRSCCLILAN

EPSS

0.32%

23.1th percentile

Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
backdrop	backdrop	>= 0 < 1.27.3	1.27.3
backdrop	backdrop	>= 1.28.0 < 1.28.2	1.28.2
backdropcms	backdrop	>= 1.27.0 < 1.27.3	1.27.3
backdropcms	backdrop	>= 1.28.0 < 1.28.2	1.28.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.