PT-2023-25700 · Contao · Contao

Christian Pöschl + 1 · Published 2023-07-25 · Updated 2023-11-15 · CVE-2023-36806

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Contao versions 4.0.0 through 4.9.41 Contao versions 4.13.0 through 4.13.27 Contao versions 5.0.0 through 5.1.9

Description Contao is an open source content management system. It is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview and on the website. Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget.

Recommendations For Contao versions 4.0.0 through 4.9.41, update to Contao 4.9.42. For Contao versions 4.13.0 through 4.13.27, update to Contao 4.13.28. For Contao versions 5.0.0 through 5.1.9, update to Contao 5.1.10. As a temporary workaround, consider disabling the login for all untrusted back end users.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-36806

GHSA-4GPR-P634-922X

Affected Products

Contao

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36806.json · Exploit
• 🔥 https://herolab.usd.de/security-advisories/usd-2023-0020 · Exploit
• https://github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80e915d37cd32 · Patch
• https://github.com/contao/contao/security/advisories/GHSA-4gpr-p634-922x · Vendor Advisory
• https://github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4 · Patch
• https://github.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82b · Patch
• https://osv.dev/vulnerability/CVE-2023-36806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36806 · Security Note
• https://osv.dev/vulnerability/GHSA-4gpr-p634-922x · Vendor Advisory
• https://github.com/contao/contao · Note
• https://t.me/cvenotify/55121 · Telegram Post
• https://t.me/cvenotify/59867 · Telegram Post