Description
Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | contao/contao | >= 4.5.0, < 4.9.16 | 4.9.16 | GHSA-h58v-c6rf-g9f7 |
| Packagist | contao/contao | >= 4.10.0, < 4.11.5 | 4.11.5 | GHSA-h58v-c6rf-g9f7 |
| Packagist | contao/core-bundle | >= 4.5.0, < 4.9.16 | 4.9.16 | GHSA-h58v-c6rf-g9f7 |
| Packagist | contao/core-bundle | >= 4.10.0, < 4.11.5 | 4.11.5 | GHSA-h58v-c6rf-g9f7 |