Skip to content
OpenAdvisories
Medium · 5.9 CVE-2021-35955 EUVD-2021-1756GHSA-hr3h-x6gq-rqcp

Cross site scripting via HTML attributes in the back end

Published Aug 12, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Package: contao/contao Package: contao/core-bundle Ecosystem: Packagist

Description

Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist contao/contao >= 4.0.0, < 4.4.56 4.4.56 GHSA-hr3h-x6gq-rqcp
Packagist contao/contao >= 4.5.0, < 4.9.18 4.9.18 GHSA-hr3h-x6gq-rqcp
Packagist contao/contao >= 4.10.0, < 4.11.7 4.11.7 GHSA-hr3h-x6gq-rqcp
Packagist contao/core-bundle >= 4.0.0, < 4.4.56 4.4.56 GHSA-hr3h-x6gq-rqcp
Packagist contao/core-bundle >= 4.5.0, < 4.9.18 4.9.18 GHSA-hr3h-x6gq-rqcp
Packagist contao/core-bundle >= 4.10.0, < 4.11.7 4.11.7 GHSA-hr3h-x6gq-rqcp

References