CVE-2024-28191

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-28191

3.1 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

C

ontao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.

References
Link Resource
https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator Vendor Advisory
https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919 Patch
https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b Patch
https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8 Vendor Advisory
https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator Vendor Advisory
https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919 Patch
https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b Patch
https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*
cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*
History

17 Jan 2025, 15:39

Type Values Removed Values Added
First Time Contao contao
Contao
CPE cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*
References () https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator - () https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator - Vendor Advisory
References () https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919 - () https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919 - Patch
References () https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b - () https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b - Patch
References () https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8 - () https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8 - Vendor Advisory

21 Nov 2024, 09:05

Type Values Removed Values Added
References () https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator - () https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator -
References () https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919 - () https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919 -
References () https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b - () https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b -
References () https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8 - () https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8 -
Information

Published : 2024-04-09 14:15

Updated : 2025-01-17 15:39

NVD link : CVE-2024-28191

Mitre link : CVE-2024-28191

CVE.ORG link : CVE-2024-28191

JSON object : View

Products Affected

contao

CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')