PT-2019-12345 · Contao · Contao

David Wind · Publicado 2019-07-09 · Atualizado 2022-05-24 · CVE-2019-11512

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contao versions prior to 4.4.39 Contao versions prior to 4.7.5

Description The issue allows SQL Injection. A penetration tester discovered that the SQL injection vulnerability can still be exploited in the file manager in Contao 4.

Recommendations For Contao versions prior to 4.4.39, update to Contao 4.4.39 or later. For Contao versions prior to 4.7.5, update to Contao 4.7.5 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-11512

GHSA-VQ59-X6MQ-4WGW

Produtos afetados

Contao

Referências · 8

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-11512.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-11512.yaml · Exploit
• https://github.com/contao/contao/commit/87d92f823b08b91a0aeb522284537c8afcdb8aba · Nota
• https://osv.dev/vulnerability/CVE-2019-11512 · Aviso do Fabricante
• https://contao.org/en/news/security-vulnerability-cve-2019-11512.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11512 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11512 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vq59-x6mq-4wgw · Aviso do Fabricante