N/A

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be required to have the "Synchronize, import, and export configuration" permission, a permission that only trusted administrators should be given. Other measures in the product prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.

N/A

N/A

Backdrop CMS 信息泄露漏洞

Backdrop CMS是一套开源的内容管理系统（CMS）。 Backdrop CMS 1.13.5之前的1.13.x版本和1.14.2之前的1.14.x版本中存在安全漏洞，该漏洞源于程序没有充分检查上传的归档文件的无效数据。攻击者可利用该漏洞将非配置脚本上传到服务器上。

N/A

N/A