CVE-2024-28234

2024-04-0914:15:08

CWE-74

GitHub_M

web.nvd.nist.gov

contao cms

css injection

bbcode

comments

security patch

vulnerability

nvd

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

6.5

Confidence

High

EPSS

Percentile

15.5%

JSON

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.

Affected configurations

Vulners

Node

contaocontaoRange2.0.0–4.13.40

contaocontaoRange5.0.0–5.3.4

VendorProductVersionCPE
contaocontao*cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
contao	contao	*	cpe:2.3:a:contao:contao::::::::

CNA Affected

[
  {
    "vendor": "contao",
    "product": "contao",
    "versions": [
      {
        "version": ">= 2.0.0, < 4.13.40",
        "status": "affected"
      },
      {
        "version": ">= 5.0.0, < 5.3.4",
        "status": "affected"
      }
    ]
  }
]