Cross site scripting in the system log

Date: 2018-04-18 CVE ID: CVE-2018-10125

Description

With a manipulated request, an attacker can implant a script which is executed when a logged in back end user opens the system log. The attacker does not have to be logged in.

Affected versions

Contao 3.* up to 3.5.33
Contao 4.0
Contao 4.1
Contao 4.2
Contao 4.3
Contao 4.4 up to 4.4.16
Contao 4.5 up to 4.5.6

Suggested solution

Update to Contao 3.5.34, 4.4.17 or 4.5.7.