Log in Start free

Vulnerability · Published Jul 25, 2023 · Assigned by GitHub_M

CVE-2023-36806Contao cross site scripting vulnerability via input unit widget

Medium 6.5

In plain English

A medium-severity cross-site scripting in contao from contao. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 49.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistcontao/core-bundle4.9.42GHSA-4gpr-p634-922x
Packagistcontao/core-bundle4.13.28GHSA-4gpr-p634-922x
Packagistcontao/core-bundle5.1.10GHSA-4gpr-p634-922x

Affected products (as reported)

VendorProductVersions
contao contao >= 4.0.0, < 4.9.42>= 4.10.0, < 4.13.28>= 5.0.0, < 5.1.10

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

References