PT-2019-15923 · Contao · Contao

Leo Feyer · Publicado 2019-12-17 · Atualizado 2019-12-31 · CVE-2019-19712

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Contao versions 4.0 through 4.8.5

Description The issue allows back end users to manipulate the details view URL, enabling them to show pages and articles that have not been enabled for them.

Recommendations For Contao versions 4.0 through 4.8.5, update to Contao 4.4.46 or 4.8.6.

Exploit

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2019-19712

GHSA-4MVC-QC5W-V5QR

Produtos afetados

Contao

Referências · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19712.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19712.yaml · Exploit
• https://github.com/contao/contao · Nota
• https://github.com/contao/contao/security/advisories/GHSA-4mvc-qc5w-v5qr · Nota
• https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19712 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-4mvc-qc5w-v5qr · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19712 · Nota
• https://osv.dev/vulnerability/CVE-2019-19712 · Aviso do Fabricante
• https://contao.org/en/news.html · Aviso do Fabricante