Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2019-19714

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

VectorNETWORK

PublishedDec 17, 2019, 15:15

Published Bycve@mitre.org

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

contao/core-bundle(Packagist)4.8.44.8.6N/A

contao/contao(Packagist)4.8.44.8.6N/A

References

https://contao.org/en/news.html
https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module.html

Weakness Type

CWE-116

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK