GitHub Advisoryadvisory · Packagist
GHSA-9jh5-qf84-x6pr Contao: Possible cookie sharing with external domains while checking protected pages for broken links
HIGH
Official page ↗
- Aliases
- CVE-2024-28235
- Ecosystem
- Packagist
- Packages
- contao/core-bundle
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-200
- Reviewed
- 2024-04-09
Affected packages
• Packagist contao/core-bundle: >= 4.9.0, < 4.13.40 → fixed in 4.13.40
• Packagist contao/core-bundle: >= 5.0.0-RC1, < 5.3.4 → fixed in 5.3.4
Description
Impact
If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs.
Patches
Update to Contao 4.13.40 or 5.3.4.
Workarounds
Disable crawling protected pages.
References
https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Related
Alias · CVE (1)
- CVE-2024-28235 Contao is an open source content management system. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr web
- https://nvd.nist.gov/vuln/detail/CVE-2024-28235 advisory
- https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16 web
- https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d web
- https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler web
- https://github.com/contao/contao package
- https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129 web