#VU30511 Information disclosure in Backdrop CMS - CVE-2019-19902

 

#VU30511 Information disclosure in Backdrop CMS - CVE-2019-19902

Published: December 19, 2019 / Updated: July 17, 2020


Vulnerability identifier: #VU30511
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2019-19902
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Backdrop CMS
Software vendor:
Backdrop CMS

Description

The vulnerability allows a remote privileged user to execute arbitrary code.

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be required to have the "Synchronize, import, and export configuration" permission, a permission that only trusted administrators should be given. Other measures in the product prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.


Remediation

Install update from vendor's website.

External links