CVE-2024-45965

🗓️ 02 Oct 2024 00:00:00Reported by mitreType

Contao 5.4.1 allows admin to upload malicious SVG file for XSS attac

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-45965	2 Oct 202423:03	–	circl
CNNVD	Contao 代码问题漏洞	2 Oct 202400:00	–	cnnvd
CVE	CVE-2024-45965	2 Oct 202400:00	–	cve
EUVD	EUVD-2024-3089	3 Oct 202520:07	–	euvd
Github Security Blog	Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript	2 Oct 202421:30	–	github
NVD	CVE-2024-45965	2 Oct 202420:15	–	nvd
OSV	CVE-2024-45965	2 Oct 202400:00	–	osv
OSV	GHSA-MRW8-5368-PHM3 Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript	2 Oct 202421:30	–	osv
Positive Technologies	PT-2024-31859	2 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-45965	24 Mar 202520:18	–	redhatcve

[
  {
    "defaultStatus": "unaffected",
    "product": "Contao",
    "vendor": "Contao",
    "versions": [
      {
        "lessThan": "4.13.54",
        "status": "affected",
        "version": "4.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.3.30",
        "status": "affected",
        "version": "5.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.5.6",
        "status": "affected",
        "version": "5.4.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
contao	www.contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads
grimthereaperteam	www.grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb

24 Mar 2025 19:04Current

CVSS 3.16.4

EPSS0.00318

CWE-434