CVE-2022-34530
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
Risk Assessment
The risk is that an attacker can compile a list of valid usernames, which can be used as a stepping stone for brute-force or social engineering attacks against administrator and user accounts.
Recommendation
It is recommended to immediately update Backdrop CMS to the latest stable version that fixes this vulnerability. If an update is not possible, consider implementing temporary mitigations such as restricting access to the login page or deploying response-delaying mechanisms.
Other vulnerabilities in Backdrop CMS
See all- CVE-2025-71310Low
The GDPR cookies module for Backdrop CMS before version 1.x-1.3.5 does not sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. The attack is mitigated by the fact that an attacker must have a role with permission to create or edit GDPR Cookies services and the site must have a YouTube service configured.
- CVE-2025-44141Medium
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30. It allows injection of malicious JavaScript code into the page.
Original NVD description (English source)
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS