CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45604 – Directory traversal in the file selector widget in contao/core-bundle
https://notcve.org/view.php?id=CVE-2024-45604
17 Sep 2024 — Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability. • https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-45398 – Remote command execution through file upload in contao/core-bundle
https://notcve.org/view.php?id=CVE-2024-45398
17 Sep 2024 — Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does not execute PHP files and other scripts in the Contao file upload directory. • https://contao.org/en/security-advisories/remote-command-execution-through-file-uploads • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30262 – Contao's remember-me tokens will not be cleared after a password change
https://notcve.org/view.php?id=CVE-2024-30262
09 Apr 2024 — Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module. • https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9 • CWE-384: Session Fixation CWE-613: Insufficient Session Expiration •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-28235 – Contao possible cookie sharing with external domains while checking protected pages for broken links
https://notcve.org/view.php?id=CVE-2024-28235
09 Apr 2024 — Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages. Contao es un sistema de gestión de contenidos de código abierto. • https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-28234 – Contao has insufficient BBCode sanitizer
https://notcve.org/view.php?id=CVE-2024-28234
09 Apr 2024 — Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments. • https://contao.org/en/security-advisories/insufficient-bbcode-sanitization • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-28191 – Contao may have unencoded insert tags in the frontend
https://notcve.org/view.php?id=CVE-2024-28191
09 Apr 2024 — Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character. Contao es un sistema de gestión de contenidos de código abierto. • https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-28190 – Contao core bundle vulnerable to cross site scripting in the file manager
https://notcve.org/view.php?id=CVE-2024-28190
09 Apr 2024 — Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users. Contao es un sistema de gestión de contenidos de código abierto. • https://contao.org/en/security-advisories/cross-site-scripting-in-the-file-manager • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2023-36806 – Contao cross site scripting vulnerability via input unit widget
https://notcve.org/view.php?id=CVE-2023-36806
25 Jul 2023 — Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.2... • https://github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-29200 – contao/core-bundle has path traversal vulnerability in the file manager
https://notcve.org/view.php?id=CVE-2023-29200
25 Apr 2023 — Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds. • https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-35955
https://notcve.org/view.php?id=CVE-2021-35955
12 Aug 2021 — Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7. Contao versiones posteriores a 4.0.0 incluyéndola, permite un ataque de tipo XSS de backend por medio de atributos HTML a un campo HTML. Corregido en versiones 4.4.56, 4.9.18, 4.11.7 • https://contao.org/en/news/contao-4-9-16-and-4-11-5-are-available.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •