Threat database

Backdrop CMS versions 1.34.x before 1.34.6 and 1.35.x before 1.35.2 have a vulnerability where uploaded SVG images are not sufficiently validated to exclude dangerous SVG tags. This can allow execution of embedded scripting if the SVG is accessed directly by URL. The risk is mitigated by the fact that SVGs are normally embedded within <img> tags, which prevents script execution, and the attacker must have upload privileges. The vulnerability is rated medium severity with a CVSS score of 5.3.

Backdrop CMS versions 1.34.x before 1.34.6 and 1.35.x before 1.35.2 have a vulnerability related to improper handling of tokens in the token browser. The system does not sufficiently restrict access to token types available for selection, potentially exposing sensitive dynamic data placeholders. However, individual token names remain protected.

Backdrop CMS versions 1.34 before 1.34.5 and 1.35 before 1.35.1 have a vulnerability where configuration export archives are not properly cleaned up after creation. This can lead to multiple configuration archive files persisting on the system. The vulnerability requires that the export operation was previously requested by a user with the 'Synchronize, import, and export configuration' permission. A related issue allows remote anonymous access to one specific archive filename, but this is separate from the main incomplete cleanup flaw.

The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission "Create a GDPR Cookies Service" or "Edit any GDPR Cookies Service" and a site must have added a YouTube service as configuration.