Lucene search

GoogleOSV:CVE-2024-28191

HistoryApr 09, 2024 - 2:15 p.m.

CVE-2024-28191

2024-04-0914:15:08

Google

osv.dev

contao cms

insert tags

frontend forms

user data

security issue

patch

3.1 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

3.8 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.

CPENameOperatorVersion
contaoeq4.13.7
contaoeq4.4.37
contaoeq4.9.0-RC1
contaoeq4.6.3
contaoeq4.10.7
contaoeq4.12.1
contaoeq4.9.3
contaoeq4.12.7
contaoeq4.10.4
contaoeq4.6.14

Name	Operator	Version
contao	eq	4.13.7
contao	eq	4.4.37
contao	eq	4.9.0-RC1
contao	eq	4.6.3
contao	eq	4.10.7
contao	eq	4.12.1
contao	eq	4.9.3
contao	eq	4.12.7
contao	eq	4.10.4
contao	eq	4.6.14

Rows per page:

1-10 of 1961

References

contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator

github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919

github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b

github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8

3.1 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

3.8 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

Related for OSV:CVE-2024-28191