CVE-2019-14771

Description

Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the "Synchronize, import, and export configuration" permission, a permission that only trusted administrators should be given. Other preventative measures in Backdrop CMS prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.) Note: This has been disputed by multiple 3rd parties due to advanced permissions that are needed to exploit.

Category

9.8
CVSS
Severity: Critical
CVSS 3.0 •
CVSS 2.0 •
EPSS 0.97% Top 25%
Vendor Advisory backdropcms.org
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
https://backdropcms.org/security/backdrop-sa-core-2019-012 vendor advisory

Frequently Asked Questions

What is the severity of CVE-2019-14771?
CVE-2019-14771 has been scored as a critical severity vulnerability.
How to fix CVE-2019-14771?
To fix CVE-2019-14771, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2019-14771 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2019-14771 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.