Is CVE-2019-19902 actively exploited?

No active exploitation of CVE-2019-19902 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-19902 be exploited remotely?

Yes. CVE-2019-19902 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2019-19902?

CVE-2019-19902 has a CVSS score of 7.2 (HIGH).

HOME VULNERABILITIESCVE-2019-19902

HIGH

CVE-2019-19902

CWE-20Published: December 19, 2019· Updated: Jun 17, 2026

7.2

CVSS v3.1

Official Description

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be required to have the "Synchronize, import, and export configuration" permission, a permission that only trusted administrators should be given. Other measures in the product prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.

NVD Source

Technical Analysis

CVE-2019-19902 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.2.