Description

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.

INFO

Published Date :

2024-04-09T13:54:22.129Z

Last Modified :

2024-08-02T00:48:49.484Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-28191 vulnerability.

Vendors Products
Contao
  • Contao
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-28191.

URL Resource
https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator cve-icon cve-icon
https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919 cve-icon cve-icon
https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b cve-icon cve-icon
https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact