UpHeron
All vulnerabilities

Servers and applications

CVE-2019-19901

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when configuring a layout, aka XSS. This issue is mitigated by the fact that the attacker would…

Severity
Medium 4.8
Published
19 Dec 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.13.5, 1.14.2
Exploit chance
0.6% in the next 30 daysHigher than 46% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Backdrop CMSServers and applications · cpe:a:backdropcms:backdrop_cms
  • From 1.13.0 before 1.13.5
  • From 1.14.0 before 1.14.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-19901
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-19901