CVE-2021-37626 PHP file inclusion via insert tags

2021-08-1122:20:10

CWE-94

GitHub_M

www.cve.org

contao cms

php

file inclusion

vulnerability

update

back end users

security fix

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

38.8%

JSON

Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify fields that are shown in the front end. Update to Contao 4.4.56, 4.9.18 or 4.11.7 to resolve. If you cannot update then disable the login for untrusted back end users.

CNA Affected

[
  {
    "product": "contao",
    "vendor": "contao",
    "versions": [
      {
        "status": "affected",
        "version": ">= 4.0.0, < 4.4.56"
      },
      {
        "status": "affected",
        "version": ">= 4.5.0, < 4.9.18"
      },
      {
        "status": "affected",
        "version": ">= 4.10.0, < 4.11.7"
      }
    ]
  }
]