PT-2021-20842 · Contao · Contao

Leofeyer · Published 2021-06-23 · Updated 2021-07-01 · CVE-2021-35210

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Contao versions 4.5.x through 4.9.x before 4.9.16 Contao versions 4.10.x through 4.11.x before 4.11.5

Description: The issue allows XSS, making it possible to inject code into the tl log table that will be executed in the browser when the system log is called in the back end.

Recommendations: Update to Contao 4.9.16 for versions 4.5.x through 4.9.x before 4.9.16. Update to Contao 4.11.5 for versions 4.10.x through 4.11.x before 4.11.5. As a temporary workaround, consider disabling the system log module in the back end for all users, especially admin users, until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-35210

GHSA-H58V-C6RF-G9F7

Affected Products

Contao

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2021-35210.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2021-35210.yaml · Exploit
• https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log-2021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35210 · Security Note
• https://osv.dev/vulnerability/GHSA-h58v-c6rf-g9f7 · Vendor Advisory
• https://github.com/contao/contao/security/advisories/GHSA-h58v-c6rf-g9f7 · Note
• https://github.com/contao/contao · Note
• https://t.me/cvenotify/16846 · Telegram Post
• https://t.me/cibsecurity/25638 · Telegram Post
• https://t.me/cvenotify/16744 · Telegram Post