PT-2023-11227 · Contao · Contao

Publicado 2023-09-20 · Atualizado 2023-09-23 · CVE-2018-5478

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contao versions 3.x through 3.5.31

Description The issue allows Cross-site Scripting (XSS) via the unsubscribe module in the frontend newsletter extension. This can be exploited to execute malicious scripts in the context of the affected application.

Recommendations For Contao versions 3.x through 3.5.31, update to version 3.5.32 or later to resolve the issue. As a temporary workaround, consider disabling the unsubscribe module in the frontend newsletter extension until a patch is available. Restrict access to the frontend newsletter extension to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-5478

GHSA-MPG7-2RX9-H5QP

Produtos afetados

Contao

Referências · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2018-5478.yaml · Exploit
• https://github.com/contao/core · Nota
• https://github.com/contao/core/commit/3123d6527ae6c46087b0ad8061eb8651cb645b8d · Nota
• https://contao.org/en/news/contao-3_5_32.html · Nota
• https://osv.dev/vulnerability/CVE-2018-5478 · Aviso do Fabricante
• https://security.snyk.io/vuln/SNYK-PHP-CONTAOCORE-70397 · Nota
• https://t.me/cibsecurity/70874 · Publicação no Telegram
• https://t.me/cvenotify/58498 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1704729441581314147 · Publicação no Twitter
• https://t.me/cvenotify/58271 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-mpg7-2rx9-h5qp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5478 · Nota de Segurança
• https://twitter.com/DMFezzaReedCISA/status/1704802365801447855 · Publicação no Twitter