GitHub Advisoryadvisory · Packagist

GHSA-r6mv-ppjc-4hgr PHP file inclusion via insert tags

MEDIUM Published 2021-08-23 Modified 2024-04-22 Official page ↗
Aliases
CVE-2021-37626
Ecosystem
Packagist
Packages
contao/core-bundle, contao/contao
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-94
Reviewed
2021-08-23

Affected packages

• Packagist contao/core-bundle: >= 4.0.0, < 4.4.56 → fixed in 4.4.56 • Packagist contao/core-bundle: >= 4.5.0, < 4.9.18 → fixed in 4.9.18 • Packagist contao/core-bundle: >= 4.10.0, < 4.11.7 → fixed in 4.11.7 • Packagist contao/contao: >= 4.0.0, < 4.4.56 → fixed in 4.4.56 • Packagist contao/contao: >= 4.5.0, < 4.9.18 → fixed in 4.9.18 • Packagist contao/contao: >= 4.10.0, < 4.11.7 → fixed in 4.11.7

Description

Impact It is possible for untrusted users to load arbitrary PHP files via insert tags. Installations are only affected if there are untrusted back end users. Patches Update to Contao 4.4.56, 4.9.18 or 4.11.7. Workarounds Disable the login for untrusted back end users. References https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags For more information If you have any questions or comments about this advisory, open an issue in contao/contao.

Related

Alias · CVE (1)

  • CVE-2021-37626 Contao is an open source CMS that allows you to create websites and scalable web applications. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References