CVE-2024-28234

Katalog CVE

CVSS 4.7 · Medium EPSS 0,57%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada contao. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.

Rincian

Terbit di NVD

9 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.7 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://contao.org/en/security-advisories/insufficient-bbcode-sanitization advisory vendor
• https://github.com/contao/contao/security/advisories/GHSA-j55w-hjpj-825g advisory vendor
• https://github.com/contao/contao/commit/55b995d8d35da0d36bc6a22c53fe6423ab0c4ae2 patch
• https://github.com/contao/contao/commit/6d42e667177c972ae7c219645593c262d7764ce2 patch