CVE-2024-28191CWE-74

Contao may have unencoded insert tags in the frontend

Low · published April 9, 2024

CVSS v3.1
3.1
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00497 · 41.7th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2024-04-09T13:54Z
EPSS history
Timeline
  • 09 APR 13:54Z
    Contao may have unencoded insert tags in the frontend
    cvelistv5