GitHub Advisoryadvisory · Packagist

GHSA-4mvc-qc5w-v5qr Information disclosure in the Contao backend

MEDIUM Published 2019-12-17 Modified 2024-04-22 Official page ↗
Aliases
CVE-2019-19712
Ecosystem
Packagist
Packages
contao/core-bundle, contao/contao
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-276
Reviewed
2019-12-17

Affected packages

• Packagist contao/core-bundle: >= 4.0.0, < 4.4.46 → fixed in 4.4.46 • Packagist contao/core-bundle: >= 4.5.0, < 4.8.6 → fixed in 4.8.6 • Packagist contao/contao: >= 4.0.0, < 4.4.46 → fixed in 4.4.46 • Packagist contao/contao: >= 4.5.0, < 4.8.6 → fixed in 4.8.6

Description

Impact Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/information-disclosure-in-the-back-end For more information If you have any questions or comments about this advisory, open an issue in contao/contao.

Related

Alias · CVE (1)

  • CVE-2019-19712 Contao 4.0 through 4.8.5 has Insecure Permissions. vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References