CVE-2025-57758

Katalog CVE

CVSS 4.3 · Medium EPSS 0,25%

Kerentanan Improper Access Control pada contao. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.

Rincian

Terbit di NVD

28 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 14,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://contao.org/en/security-advisories/improper-access-control-in-the-back-end-voters advisory vendor
• https://github.com/contao/contao/commit/3f05c603e1c94d34819f837f060df5d66447d0d7 patch
• https://github.com/contao/contao/security/advisories/GHSA-7m47-r75r-cx8v advisory pihak ketiga