VYPR
← All advisories
Medium severity4.8NVD Advisory· Published Dec 19, 2019· Updated Jun 17, 2026

CVE-2019-19903

CVE-2019-19903

Description

An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying file type descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when viewing the list of file types, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the "Administer file types" permission.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Backdrop CMS/Backdrop CMSdescription
  • Backdropcms/Backdrop CMSllm-fuzzy2 versions
    <1.14.2+ 1 more
    • (no CPE)range: <1.14.2
    • cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:*range: >=1.13.0,<1.13.5

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.