Vulnerability · Published Apr 9, 2024 · Assigned by GitHub_M

CVE-2024-28190Contao core bundle vulnerable to cross site scripting in the file manager

Medium 5.4

In plain English

A medium-severity cross-site scripting in contao from contao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.5%top 56.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	contao/core-bundle	4.13.40	GHSA-v24p-7p4j-qvvf
Packagist	contao/core-bundle	5.3.4	GHSA-v24p-7p4j-qvvf

Affected products (as reported)

Vendor	Product	Versions
contao	contao	>= 4.0.0, < 4.13.40>= 5.0.0, < 5.3.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/contao/contao/security/advisories/GHSA-v24p-7p4j-qvvf x_refsource_CONFIRM
https://github.com/contao/contao/commit/878d28dbe0f408740555d6fc8b634bd3f8febfce x_refsource_MISC
https://github.com/contao/contao/commit/b794e14fff070101bf6a885da9b1a83395093b4d x_refsource_MISC
https://contao.org/en/security-advisories/cross-site-scripting-in-the-file-manager x_refsource_MISC