Skip to content
OpenAdvisories
High WID-SEC-2024-2152 3 CVEs

Contao: Mehrere Schwachstellen

Published Sep 16, 2024 · Updated Sep 16, 2024 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen.

Product

Contao ist ein Open Source Content Management System zur Erstellung von Websites und Webanwendungen.

Vulnerabilities 3

  • High 8.3
    CVE-2024-45398

    Remote command execution through file upload in contao/core-bundle

    Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to…

    contao contao contao/core-bundle Packagist
  • Medium 5.3
    CVE-2024-45612

    Insert tag injection via canonical URL in Contao

    Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade sh…

    contao contao contao/core-bundle Packagist
  • Medium 4.3
    CVE-2024-45604

    Directory traversal in the file selector widget in contao/core-bundle

    Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

    contao contao contao/core-bundle Packagist

Revision history

  1. #1

    Initiale Fassung

References