CVE-2024-28191

Katalog CVE

CVSS 5.4 · Medium EPSS 0,50%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada contao. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.

Rincian

Terbit di NVD

9 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator advisory vendor
• https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8 advisory vendor
• https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919 patch
• https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b patch