CVE-2024-28191
Contao may have unencoded insert tags in the frontend
- State
- Published
- Severity
- 3.1 Low
- Published
- Apr 9, 2024
- Updated
- Aug 2, 2024
- Reserved
- Mar 6, 2024
Description
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.1 Low | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N | GitHub_M |
Weaknesses
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected Products
| Product | Versions |
|---|---|
contaocontao |
|
References
- https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8
- https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919
- https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b
- https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.