PT-2020-16192 · Contao · Contao

Leo Feyer · Published 2020-09-24 · Updated 2021-07-21 · CVE-2020-25768

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contao versions 4.4.0 through 4.4.51 Contao versions 4.9.0 through 4.9.5 Contao versions 4.10.0 through 4.10.0

Description The issue is related to Improper Input Validation, allowing the injection of insert tags in front end forms. These tags will be replaced when the page is rendered.

Recommendations Update to Contao version 4.4.52. Update to Contao version 4.9.6. Update to Contao version 4.10.1. As a temporary workaround, consider disabling the front end login form. Avoid using form fields with array keys such as fieldname[] until the issue is resolved.

Exploit

Fix

Special Elements Injection

RCE

Weakness Enumeration

CWE-74

CWE-20

Related Identifiers

CVE-2020-25768

GHSA-F7WM-X4GW-6M23

Affected Products

Contao

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2020-25768.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2020-25768.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-f7wm-x4gw-6m23 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25768 · Security Note
• https://community.contao.org/en/forumdisplay.php?4-Announcements · Vendor Advisory
• https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25768 · Vendor Advisory
• https://github.com/contao/contao · Note
• https://github.com/contao/contao/security/advisories/GHSA-f7wm-x4gw-6m23 · Note
• https://t.me/cibsecurity/15136 · Telegram Post