CVE-2022-42095

Deeper analysis

Backdrop CMS version 1.23.0 contains a stored cross-site scripting vulnerability, tracked as CVE-2022-42095 and assigned CWE-79, that is triggered through the Page content component. The flaw received a CVSS 3.1 score of 4.8, reflecting network attack vector, low attack complexity, high privileges required, and required user interaction, with limited confidentiality and integrity impact under changed scope.

An authenticated administrator can supply malicious script content that is stored and later rendered for other users who view the affected page, enabling the attacker to execute arbitrary JavaScript in the context of those victims. Exploitation therefore requires an account with page-editing rights and succeeds only when a victim interacts with the rendered page.

Public references include the Backdrop project site, the 1.23.0 release tag, and several proof-of-concept repositories and write-ups that demonstrate the injection vector, but none of the listed sources detail specific patch versions or configuration mitigations.

The EPSS score for this CVE rose materially from a low baseline to a peak of 0.5315 on 2025-12-11 before receding to the current value of 0.1412, indicating a period of increased exploitation interest well after the original disclosure.