GitHub Advisoryadvisory · Packagist

GHSA-4r6g-xhx7-fm36 Contao Core directory traversal vulnerability

MEDIUM Published 2022-05-17 Modified 2024-04-25 Official page ↗
Aliases
CVE-2015-0269
Ecosystem
Packagist
Packages
contao/core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2024-04-25

Affected packages

• Packagist contao/core: >= 3.4.0, < 3.4.4 → fixed in 3.4.4 • Packagist contao/core: >= 2.0.0, < 3.2.19 → fixed in 3.2.19

Description

Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated backend users to view files outside their file mounts or the document root via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2015-0269 Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References