PT-2019-15923 · Contao · Contao

Leo Feyer · Published 2019-12-17 · Updated 2019-12-31 · CVE-2019-19712

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Contao versions 4.0 through 4.8.5

Description The issue allows back end users to manipulate the details view URL, enabling them to show pages and articles that have not been enabled for them.

Recommendations For Contao versions 4.0 through 4.8.5, update to Contao 4.4.46 or 4.8.6.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2019-19712

GHSA-4MVC-QC5W-V5QR

Affected Products

Contao

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19712.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19712.yaml · Exploit
• https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19712 · Security Note
• https://osv.dev/vulnerability/GHSA-4mvc-qc5w-v5qr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19712 · Vendor Advisory
• https://contao.org/en/news.html · Vendor Advisory
• https://github.com/contao/contao · Note
• https://github.com/contao/contao/security/advisories/GHSA-4mvc-qc5w-v5qr · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19712 · Note