GHSA-wxxw-5gq6-j2g5 json
contao/core Insufficient input validation allows for code injection and remote execution
published 2y ago modified last yr.
- cvss
- 9.0
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation. In fact, attackers can remove or change pathconfig.php by entering a URL, meaning that the entire Contao installation will no longer be accessible or malicious code can be executed.
Patch / fix
- packagist contao/core 2.11.17, 3.2.9
- github.com/contao/core@d455035 commit
- github.com/contao/core@d4a14f1 commit
Is GHSA-wxxw-5gq6-j2g5 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | contao/core | >=2.0.0, <2.11.17 >=3.0.0, <3.2.9 |
2.11.17 3.2.9 |
References
-
github.com
/contao/core/commit/d45503568751a868193929ef349a49ae5e6686f0
web
-
github.com
/contao/core/commit/d4a14f167e0cbb2e77c7829299e5b36f55c1ebce
web
-
github.com
/contao/core/issues/6855
web
-
c-c-a.org
/aktuelles/news/details/eine-neue-kritische-sicherheitsluecke-in-contao-entdeckt
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/contao/core/2014-04-07.yaml
web
-
web.archive.org
/web/20240214121817/https://contao.org/en/news/new-security-hole-found-in-contao
web
Sources
- GitHub Advisory GHSA-wxxw-5gq6-j2g5
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.