CVEvulnerability
CVE-2024-28234
4.7 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2024-04-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- CVSS 3.1 ([email protected])
- 4.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
- Weaknesses
- CWE-74
Description
Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.
Affected configurations
• contao contao (>= 2.0 < 4.13.40)
• contao contao (>= 5.0.0 < 5.3.4)
Related
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://contao.org/en/security-advisories/insufficient-bbcode-sanitization Vendor Advisory
- https://github.com/contao/contao/commit/55b995d8d35da0d36bc6a22c53fe6423ab0c4ae2 Patch
- https://github.com/contao/contao/commit/6d42e667177c972ae7c219645593c262d7764ce2 Patch
- https://github.com/contao/contao/security/advisories/GHSA-j55w-hjpj-825g Vendor Advisory
- https://contao.org/en/security-advisories/insufficient-bbcode-sanitization Vendor Advisory
- https://github.com/contao/contao/commit/55b995d8d35da0d36bc6a22c53fe6423ab0c4ae2 Patch
- https://github.com/contao/contao/commit/6d42e667177c972ae7c219645593c262d7764ce2 Patch
- https://github.com/contao/contao/security/advisories/GHSA-j55w-hjpj-825g Vendor Advisory