CVE-2024-28234
Contao has insufficient BBCode sanitizer
- State
- Published
- Severity
- 4.3 Medium
- Published
- Apr 9, 2024
- Updated
- Aug 2, 2024
- Reserved
- Mar 7, 2024
Description
Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | GitHub_M |
Weaknesses
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected Products
| Product | Versions |
|---|---|
contaocontao |
|
References
- https://github.com/contao/contao/security/advisories/GHSA-j55w-hjpj-825g
- https://github.com/contao/contao/commit/55b995d8d35da0d36bc6a22c53fe6423ab0c4ae2
- https://github.com/contao/contao/commit/6d42e667177c972ae7c219645593c262d7764ce2
- https://contao.org/en/security-advisories/insufficient-bbcode-sanitization
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.