PT-2024-32386 · Contao+1 · Contao Open Source Cms+1

Usdresponsibledisclosure · Published 2024-07-26 · Updated 2024-09-30 · CVE-2024-47069

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oveleon Cookie Bar versions prior to 1.16.3 and 2.1.3

Description The block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the backend's HTTP response, thereby causing reflected cross-site scripting. This issue affects Oveleon Cookie Bar, a tool for the Contao Open Source CMS that lets visitors set cookie and privacy preferences.

Recommendations For versions prior to 1.16.3, update to version 1.16.3 or later. For versions prior to 2.1.3, update to version 2.1.3 or later. As a temporary workaround, consider disabling the block/locale endpoint until a patch is available. Restrict access to the block/locale endpoint to minimize the risk of exploitation. Sanitize the locale input to prevent XSS payloads from being executed in a user's browser.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47069

GHSA-296Q-RJ83-G9RQ

Affected Products

Contao Open Source Cms

Oveleon Cookie Bar

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47069.json · Exploit
• 🔥 https://github.com/oveleon/contao-cookiebar/security/advisories/GHSA-296q-rj83-g9rq · Exploit
• https://github.com/oveleon/contao-cookiebar/commit/1d57470be5878f66d5e1e23f624dd387564b9b8d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-47069 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47069 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-296q-rj83-g9rq · Vendor Advisory
• https://github.com/oveleon/contao-cookiebar · Note
• https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php · Note
• https://t.me/cvedetector/6188 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1838298642572083584 · Twitter Post
• https://twitter.com/CVEnew/status/1838244763708838239 · Twitter Post
• https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html · Note