| Package | Affected versions | Patched versions |
|---|---|---|
| backdrop cms | ≥ 1.12.0, < 1.12.8≥ 1.13.0, < 1.13.3 | 1.12.81.13.3 |
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the "Synchronize, import, and export configuration" permission, a permission that only trusted administrators should be given. Other preventative measures in Backdrop CMS prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.) Note: This has been disputed by multiple 3rd parties due to advanced permissions that are needed to exploit.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free