PT-2023-11227 · Contao · Contao

Published 2023-09-20 · Updated 2023-09-23 · CVE-2018-5478

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contao versions 3.x through 3.5.31

Description The issue allows Cross-site Scripting (XSS) via the unsubscribe module in the frontend newsletter extension. This can be exploited to execute malicious scripts in the context of the affected application.

Recommendations For Contao versions 3.x through 3.5.31, update to version 3.5.32 or later to resolve the issue. As a temporary workaround, consider disabling the unsubscribe module in the frontend newsletter extension until a patch is available. Restrict access to the frontend newsletter extension to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-5478

GHSA-MPG7-2RX9-H5QP

Affected Products

Contao

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2018-5478.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2018-5478 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mpg7-2rx9-h5qp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5478 · Security Note
• https://github.com/contao/core · Note
• https://github.com/contao/core/commit/3123d6527ae6c46087b0ad8061eb8651cb645b8d · Note
• https://contao.org/en/news/contao-3_5_32.html · Note
• https://security.snyk.io/vuln/SNYK-PHP-CONTAOCORE-70397 · Note
• https://t.me/cibsecurity/70874 · Telegram Post
• https://t.me/cvenotify/58498 · Telegram Post
• https://twitter.com/CVEnew/status/1704729441581314147 · Twitter Post
• https://t.me/cvenotify/58271 · Telegram Post
• https://twitter.com/DMFezzaReedCISA/status/1704802365801447855 · Twitter Post