GitHub Advisoryadvisory · Packagist

GHSA-x5g4-crxq-qxjx Contao Core directory traversal vulnerability

HIGH Published 2022-05-13 Modified 2024-04-25 Official page ↗
Aliases
CVE-2017-10993
Ecosystem
Packagist
Packages
contao/contao, contao/core-bundle, contao/core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2024-04-25

Affected packages

• Packagist contao/contao: >= 4.0.0, < 4.4.1 → fixed in 4.4.1 • Packagist contao/core-bundle: >= 4.0.0, < 4.4.1 → fixed in 4.4.1 • Packagist contao/core: >= 3.0.0, < 3.5.28 → fixed in 3.5.28

Description

A logged in back end user can include arbitrary PHP files by manipulating an URL parameter. Since Contao does not allow to upload PHP files in the file manager, the attack is limited to the existing PHP files on the server.

Related

Alias · CVE (1)

  • CVE-2017-10993 Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References