CVE-2024-28235CWE-200

Contao possible cookie sharing with external domains while checking protected pages for broken links

High · published April 9, 2024

CVSS v3.1
8.4
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00708 · 52.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-04-09T15:50Z
EPSS history
Timeline
  • 09 APR 15:50Z
    Contao possible cookie sharing with external domains while checking protected pages for broken links
    cvelistv5