GitHub Advisoryadvisory · Packagist

GHSA-h58v-c6rf-g9f7 Cross site scripting in the system log

MEDIUM Published 2021-07-01 Modified 2025-04-17 Official page ↗
Aliases
CVE-2021-35210
Ecosystem
Packagist
Packages
contao/core-bundle, contao/contao
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-06-23

Affected packages

• Packagist contao/core-bundle: >= 4.5.0, < 4.9.16 → fixed in 4.9.16 • Packagist contao/core-bundle: >= 4.10.0, < 4.11.5 → fixed in 4.11.5 • Packagist contao/contao: >= 4.5.0, < 4.9.16 → fixed in 4.9.16 • Packagist contao/contao: >= 4.10.0, < 4.11.5 → fixed in 4.11.5

Description

Impact It is possible to inject code into the `tl_log` table that will be executed in the browser when the system log is called in the back end. Patches Update to Contao 4.9.16 or 4.11.5. Workarounds Disable the system log module in the back end for all users (especially admin users). References https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log-2021 For more information If you have any questions or comments about this advisory, open an issue in contao/contao.

Related

Alias · CVE (1)

  • CVE-2021-35210 Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References