{"action":"Upgrade backdrop/backdrop to 1.27.3 or later.","affected":[{"fixed":"1.27.3","introduced":"0"},{"fixed":"1.28.2","introduced":"1.28.0"}],"component":"backdrop/backdrop","cve_ids":["CVE-2024-41709"],"ecosystem":"Packagist","epss":0.00315,"exploited":false,"fixed_versions":["1.27.3","1.28.2"],"ghsa_id":"GHSA-3wmx-48g3-x66g","id":"tcs_01M5KETBPXJGYMMK7WMDZSDFSK","modified_at":"2025-03-21T21:58:12.046508Z","published_at":"2024-07-22T06:31:08Z","references":["https://osv.dev/vulnerability/GHSA-3wmx-48g3-x66g","https://nvd.nist.gov/vuln/detail/CVE-2024-41709","https://github.com/backdrop/backdrop/commit/c7ff0500705668e3f58263590812872e44059301","https://github.com/backdrop/backdrop/commit/f1dfe710c186fb47c9d949f01f37e5ab42b44030","https://backdropcms.org/security/backdrop-sa-core-2024-001","https://github.com/backdrop-ops/backdrop-composer"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-3wmx-48g3-x66g","url":"https://osv.dev/vulnerability/GHSA-3wmx-48g3-x66g"}],"summary":"Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places"}