Contao Cross-site Scripting Vulnerability in contao/core
Summary
CVE-2018-5478: Contao Cross-site Scripting vulnerabililty. Affects contao/core versions >= 3.0.0, < 3.5.32. Fixed in 3.5.32. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) that allows users to create and manage websites. The contao/core package is a fundamental component of Contao, providing core functionality and features. Unfortunately, this package is vulnerable to a Cross-site Scripting (XSS) attack through the unsubscribe module in the frontend newsletter extension.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability in Contao 3.x before 3.5.32 allows an attacker to inject malicious scripts into the unsubscribe module of the frontend newsletter extension. This can be exploited by tricking users into clicking on a specially crafted link or visiting a compromised website. As a result, the attacker can execute arbitrary code in the context of the victim's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Minimum fixed version
3.5.32
This is the first release that contains the fix.
composer require contao/core:3.5.32Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading Contao to the latest version.
Conclusion
In conclusion, the contao/core package in Contao is vulnerable to a Cross-site Scripting (XSS) attack through the unsubscribe module in the frontend newsletter extension. To mitigate this vulnerability, it is crucial to upgrade Contao to version 3.5.32 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for contao/core →
FAQ
Contao is an open-source content management system (CMS) used for creating and managing websites.
The contao/core package is a fundamental component of Contao, providing core functionality and features.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The Contao XSS vulnerability can be exploited by tricking users into clicking on a specially crafted link or visiting a compromised website.
The Contao XSS vulnerability can lead to unauthorized access, data theft, or other malicious activities, as attackers can execute arbitrary code in the victim's browser.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core.
