PT-2024-40514 · Contao · Contao/Core

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions contao/core versions 2.x prior to 2.11.17 contao/core versions 3.x prior to 3.2.9

Description The issue is related to arbitrary code execution on the server due to insufficient input validation. Attackers can exploit this by entering a specific URL, which allows them to remove or change pathconfig.php. This can result in the Contao installation becoming inaccessible or malicious code being executed.

Recommendations For contao/core versions 2.x prior to 2.11.17, update to version 2.11.17 or later. For contao/core versions 3.x prior to 3.2.9, update to version 3.2.9 or later.

Fix

Related Identifiers

GHSA-WXXW-5GQ6-J2G5

Affected Products

Contao/Core

References · 7

• https://osv.dev/vulnerability/GHSA-wxxw-5gq6-j2g5 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/2014-04-07.yaml · Note
• https://github.com/contao/core/commit/d4a14f167e0cbb2e77c7829299e5b36f55c1ebce · Note
• https://github.com/contao/core/commit/d45503568751a868193929ef349a49ae5e6686f0 · Note
• https://github.com/contao/core/issues/6855 · Note
• https://web.archive.org/web/20240214121817/https://contao.org/en/news/new-security-hole-found-in-contao · Note
• https://c-c-a.org/aktuelles/news/details/eine-neue-kritische-sicherheitsluecke-in-contao-entdeckt · Note