CVE-2023-36806

Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4	Patch
https://github.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82b	Patch
https://github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80e915d37cd32	Patch
https://github.com/contao/contao/security/advisories/GHSA-4gpr-p634-922x	Vendor Advisory
https://herolab.usd.de/security-advisories/usd-2023-0020/	Exploit Third Party Advisory
https://github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4	Patch
https://github.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82b	Patch
https://github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80e915d37cd32	Patch
https://github.com/contao/contao/security/advisories/GHSA-4gpr-p634-922x	Vendor Advisory
https://herolab.usd.de/security-advisories/usd-2023-0020/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:contao:contao::::::::
	cpe:2.3:a:contao:contao::::::::
	cpe:2.3:a:contao:contao::::::::

History

No history.

Information

Published : 2023-07-25 19:15

Updated : 2024-11-21 08:10

NVD link : CVE-2023-36806

Mitre link : CVE-2023-36806

CVE.ORG link : CVE-2023-36806

JSON object : View

Products Affected

contao

contao

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-36806", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2023-07-25T19:15:11.550", "references": [{"url": "https://github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80e915d37cd32", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/contao/contao/security/advisories/GHSA-4gpr-p634-922x", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://herolab.usd.de/security-advisories/usd-2023-0020/", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82b", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80e915d37cd32", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/contao/contao/security/advisories/GHSA-4gpr-p634-922x", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://herolab.usd.de/security-advisories/usd-2023-0020/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users."}], "lastModified": "2024-11-21T08:10:38.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15E0A7C9-3A78-4D4B-8871-FD3299C55F06", "versionEndExcluding": "4.9.42", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5DDD8AD-0906-478A-BAB4-5B0B4C50C517", "versionEndExcluding": "4.13.28", "versionStartIncluding": "4.10.0"}, {"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11B3001D-C6B9-44C3-B477-ECD0C4BD3397", "versionEndExcluding": "5.1.10", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}