The Salesforce module before version 1.x-1.0.1 for Backdrop CMS contributed projects does not implement a proper random state parameter in its OAuth authorization flow, leading to a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). This flaw allows attackers to potentially execute unauthorized actions by exploiting the lack of CSRF protection during the authorization process. The vulnerability has a CVSS v3.1 base score of 7.1, indicating high severity with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts with low availability impact. The module is part of a cloud service, and a patch is available to mitigate the issue.

Successful exploitation of this vulnerability could allow an attacker to perform unauthorized actions within the Salesforce module's authorization flow, potentially compromising confidentiality and integrity of data. Availability impact is low. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Since the affected module is part of a cloud service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied or apply the update to version 1.x-1.0.1 or later to ensure protection against this CSRF vulnerability.