GitHub Advisoryadvisory · Packagist
GHSA-v24p-7p4j-qvvf Contao: Cross site scripting in the file manager
MEDIUM
Official page ↗
- Aliases
- CVE-2024-28190
- Ecosystem
- Packagist
- Packages
- contao/core-bundle
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2024-04-09
Affected packages
• Packagist contao/core-bundle: >= 4.0.0, < 4.13.40 → fixed in 4.13.40
• Packagist contao/core-bundle: >= 5.0.0-RC1, < 5.3.4 → fixed in 5.3.4
Description
Impact
Users can insert malicious code into file names when uploading files, which is then executed in tooltips and popups in the backend.
Patches
Update to Contao 4.13.40 or Contao 5.3.4.
Workarounds
Disable uploads for untrusted users.
References
https://contao.org/en/security-advisories/cross-site-scripting-in-the-file-manager
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Credits
Thanks to Alexander Wuttke for reporting this vulnerability.
Related
Alias · CVE (1)
- CVE-2024-28190 Contao is an open source content management system. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/contao/contao/security/advisories/GHSA-v24p-7p4j-qvvf web
- https://nvd.nist.gov/vuln/detail/CVE-2024-28190 advisory
- https://github.com/contao/contao/commit/878d28dbe0f408740555d6fc8b634bd3f8febfce web
- https://github.com/contao/contao/commit/b794e14fff070101bf6a885da9b1a83395093b4d web
- https://contao.org/en/security-advisories/cross-site-scripting-in-the-file-manager web
- https://github.com/contao/contao package