CVE-2018-1000813
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an affected page while logged in.. This vulnerability appears to have been fixed in 1.11.1 and later.
Backdrop CMS, en versiones 1.11.0 y anteriores, contiene una vulnerabilidad Cross-Site Scripting (XSS) en el saneamiento de nombres de clase personalizados empleados en bloques y distribuciones. Esto puede resultar en la ejecución de JavaScript desde una fuente inesperada. El ataque parece ser explotable si un usuario se dirige a una página afectada mientras se inicia sesión. La vulnerabilidad parece haber sido solucionada en las versiones 1.11.1 y siguientes.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-12-20 CVE Reserved
- 2018-12-20 CVE Published
- 2024-09-17 CVE Updated
- 2024-10-29 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://backdropcms.org/security/backdrop-sa-core-2018-005 | 2019-01-06 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Backdropcms Search vendor "Backdropcms" | Backdrop Cms Search vendor "Backdropcms" for product "Backdrop Cms" | <= 1.11.0 Search vendor "Backdropcms" for product "Backdrop Cms" and version " <= 1.11.0" | - |
Affected
|