PT-2021-21076 · Contao+1 · Contao+1

Mikhail Khramenkov + 1 · Published 2021-08-12 · Updated 2021-08-25 · CVE-2021-35955

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Contao versions 4.0.0 through 4.4.55 Contao versions 4.0.0 through 4.9.17 Contao versions 4.0.0 through 4.11.6

Description: The issue allows backend cross-site scripting (XSS) via HTML attributes to an HTML field. This can be exploited by untrusted users who have the rights to modify HTML fields, such as those using TinyMCE. The malicious code can be executed both in the element preview in the back end and on the website in the front end.

Recommendations: For Contao versions 4.0.0 through 4.4.55, update to Contao 4.4.56. For Contao versions 4.0.0 through 4.9.17, update to Contao 4.9.18. For Contao versions 4.0.0 through 4.11.6, update to Contao 4.11.7. As a temporary workaround, consider disabling all fields that allow HTML for untrusted back end users or disable the login for these users.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-35955

GHSA-HR3H-X6GQ-RQCP

Affected Products

Contao

Tinymce

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2021-35955.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2021-35955.yaml · Exploit
• https://contao.org/en/news/contao-4-9-16-and-4-11-5-are-available.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35955 · Security Note
• https://osv.dev/vulnerability/GHSA-hr3h-x6gq-rqcp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35955 · Vendor Advisory
• https://github.com/contao/contao/security/advisories/GHSA-hr3h-x6gq-rqcp · Note
• https://github.com/contao/contao · Note
• https://t.me/cibsecurity/27222 · Telegram Post
• https://t.me/cvenotify/19221 · Telegram Post
• https://contao.org/en/security-advisories/cross-site-scripting-via-html-attributes-in-the-back-end.html · Note