CVEvulnerability
CVE-2019-19712
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-12-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-276
Description
Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.
Affected configurations
• contao contao (>= 4.4.0 <= 4.4.45)
• contao contao (>= 4.8 <= 4.8.5)
• contao contao 4.0
• contao contao 4.1
• contao contao 4.2
• contao contao 4.3
• contao contao 4.5
• contao contao 4.6
• contao contao 4.7
Related
Weakness · CWE (1)
- CWE-276 Incorrect Default Permissions weakness
References
- https://contao.org/en/news.html Release Notes, Vendor Advisory
- https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html Vendor Advisory
- https://contao.org/en/news.html Release Notes, Vendor Advisory
- https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html Vendor Advisory