CVE-2023-36806

Katalog CVE

CVSS 5.4 · Medium EPSS 0,64%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada contao. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.

Rincian

Terbit di NVD

25 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/contao/contao/security/advisories/GHSA-4gpr-p634-922x advisory vendor
• https://github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4 patch
• https://github.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82b patch
• https://github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80e915d37cd32 patch
• https://herolab.usd.de/security-advisories/usd-2023-0020/ exploit · advisory pihak ketiga