Vulnerability · Published Apr 9, 2024 · Assigned by GitHub_M

CVE-2024-28191Contao may have unencoded insert tags in the frontend

Low 3.1

In plain English

A low-severity injection in contao from contao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.5%top 57.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	contao/core-bundle	4.13.40	GHSA-747v-52c4-8vj8
Packagist	contao/core-bundle	5.3.4	GHSA-747v-52c4-8vj8

Affected products (as reported)

Vendor	Product	Versions
contao	contao	>= 4.0.0, < 4.13.40>= 5.0.0, < 5.3.4

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8 x_refsource_CONFIRM
https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919 x_refsource_MISC
https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b x_refsource_MISC
https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator x_refsource_MISC