Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field…
Priority LOW 27CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Fixed backdrop/backdrop (Packagist): 1.27.3, 1.28.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | backdrop/backdrop (Packagist) | before 1.27.3 | 1.27.3 | Patch available | GHSA-3wmx-48g3-x66g |
| — | backdrop/backdrop (Packagist) | 1.28.0 to before 1.28.2 | 1.28.2 | Patch available | GHSA-3wmx-48g3-x66g |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- backdrop/backdrop (Packagist) Vendor— Affected before 1.27.3 Fixed in 1.27.3 Patch available GHSA-3wmx-48g3-x66g
- backdrop/backdrop (Packagist) Vendor— Affected 1.28.0 to before 1.28.2 Fixed in 1.28.2 Patch available GHSA-3wmx-48g3-x66g
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:* | 1.27.0 to before 1.27.3; 1.28.0 to before 1.28.2 | Vulnerable | backdropcms |
- cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:* Versions 1.27.0 to before 1.27.3; 1.28.0 to before 1.28.2 Vulnerable ·backdropcms
Remediation
- Fix · GHSA-3wmx-48g3-x66g backdrop/backdrop (Packagist) Fixed in 1.27.3 Advisory →
- Fix · GHSA-3wmx-48g3-x66g backdrop/backdrop (Packagist) Fixed in 1.28.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-41709
- 2026-10-03 Alias added: GHSA-3wmx-48g3-x66g
References
Advisory 2
More backdropcms Backdrop vulnerabilities
- TI-2019-08480 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles… CVSS 3.1MEDIUM 6.1
- TI-2022-20387 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' . CVSS 3.1MEDIUM 4.8
- TI-2022-20384 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8
- TI-2021-20467 A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which… CVSS 3.1HIGH 8.8
- TI-2019-10979 Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter… CVSS 3.0MEDIUM 6.1
- TI-2022-08438 A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS… CVSS 3.1MEDIUM 5.4
Sources
- CVE-2024-41709 · CVE Program
- CVE-2024-41709 · NVD
- FIRST EPSS
- GHSA-3wmx-48g3-x66g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences