CVE-2023-36806 Contao cross site scripting vulnerability via input unit widget

Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview back end an...

Cross site scripting via input unit widget

Impact Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview back end and on the website front end. Patches Update to Contao 4.9.42, 4.13.28 or 5.1.10. Workarounds Disable login for all untrusted back end users. References...

GHSA-4GPR-P634-922X Cross site scripting via input unit widget

Impact Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview back end and on the website front end. Patches Update to Contao 4.9.42, 4.13.28 or 5.1.10. Workarounds Disable login for all untrusted back end users. References...

Contao 跨站脚本漏洞

Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management, and CSS frameworks. Contao suffers from a cross-site scripting vulnerability that originates from the possibility of an untrusted back-end user injecting malicious co...

PT-2023-25700 · Contao · Contao

Name of the Vulnerable Software and Affected Versions: Contao versions 4.0.0 through 4.9.41 Contao versions 4.13.0 through 4.13.27 Contao versions 5.0.0 through 5.1.9 Description: Contao is an open source content management system. It is possible for untrusted backend users to inject malicious co...

Cross site scripting in widgets with units

Date : 2023-07-25 CVE ID : CVE-2023-36806 Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview back end and on the website front end. Thanks to Christian Pöschl and Fabian Brenner from usd AG for reporting this vulnerability...

CVE-2023-36806: Improper Neutralization of Input During Web Page Generation

Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview back end an...

Directory Traversal

contao/contao and contao/core-bundle are vulnerable to Directory Traversal. The vulnerability exists in DCFolder.php which allows an attacker to list files outside the document root in the file manager...

GHSA-FP7Q-XHHW-6RJ3 Path traversal vulnerability in the file manager

Impact Authenticated users in the back end can list files outside the document root in the file manager. Patches Update to Contao 4.9.40, 4.13.21 or 5.1.4. Workarounds None. References https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager For more information If you ha...

Path traversal vulnerability in the file manager

Impact Authenticated users in the back end can list files outside the document root in the file manager. Patches Update to Contao 4.9.40, 4.13.21 or 5.1.4. Workarounds None. References https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager For more information If you ha...

CVE-2023-29200

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao...

Design/Logic Flaw

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao...

CVE-2023-29200 contao/core-bundle has path traversal vulnerability in the file manager

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao...

CVE-2023-29200 contao/core-bundle has path traversal vulnerability in the file manager

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao...

CVE-2023-29200

Summary: CVE-2023-29200 is a directory traversal vulnerability in Contao’s file manager (core-bundle). Prior to versions 4.9.40, 4.13.21, and 5.1.4, authenticated back-end users could trigger an Ajax request to list arbitrary files outside the document root. Some sources state that file contents ...

CVE-2023-29200 contao/core-bundle has path traversal vulnerability in the file manager

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao...

PT-2023-22197 · Contao · Contao

Name of the Vulnerable Software and Affected Versions: Contao versions prior to 4.9.40 Contao versions prior to 4.13.21 Contao versions prior to 5.1.4 Description: Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary...

Contao 路径遍历漏洞

Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. A path traversal vulnerability exists in Contao versions prior to 4.9.40, 4.13.21, and 5.1.4. An attacker exploiting this vulnerability could list...

Directory traversal in the file manager

Date : 2023-04-25 CVE ID : CVE-2023-29200 Authenticated users in the back end can list files outside the document root in the file manager. However, it is not possible to read the contents of these files. Thanks to Daniel Barros for reporting the problem. Affected versions Contao 4.0 Contao 4.1...

CVE-2023-29200: Improper Limitation of a Pathname to a Restricted Directory

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao...