Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2019-19712

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

VectorNETWORK

PublishedDec 17, 2019, 14:15

Published Bycve@mitre.org

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

contao/core-bundle(Packagist)4.0.04.4.46N/A

contao/core-bundle(Packagist)4.5.04.8.6N/A

contao/contao(Packagist)4.0.04.4.46N/A

contao/contao(Packagist)4.5.04.8.6N/A

References

https://contao.org/en/news.html
https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html

Weakness Type

CWE-276

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK