PT-2019-8137 · Contao · Contao

Leo Feyer · Publicado 2019-04-25 · Atualizado 2022-05-24 · CVE-2017-16558

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contao versions 3.0.0 through 3.5.30 Contao versions 4.0.0 through 4.4.7

Description The issue is an SQL injection vulnerability that affects both the back end and the listing module.

Recommendations For Contao versions 3.0.0 through 3.5.30, update to a version that contains a fix for this issue. For Contao versions 4.0.0 through 4.4.7, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the listing module and the back end to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-16558

GHSA-W38G-HJ45-MJJP

Produtos afetados

Contao

Referências · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/listing-bundle/CVE-2017-16558.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2017-16558.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2017-16558.yaml · Exploit
• https://github.com/contao/contao/blob/4.4.57/CHANGELOG.md#448-2017-11-15 · Nota
• https://github.com/contao/contao/commit/501cb3cd34d61089b94e7ed78da53977bc71fc3e · Nota
• https://github.com/contao/contao/commit/6b4a2711edf166c85cfd7a53fed6aea56d4f0544 · Nota
• https://contao.org/en/news/contao-4_4_8.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-16558 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16558 · Nota
• https://contao.org/de/changelog/versions/4.4.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-w38g-hj45-mjjp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16558 · Nota de Segurança