CVE-2024-28191 | BDVDB-2026-230718 Detail
contaocontao
Description#
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
References#
- https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8
- https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919
- https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b
- https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.