Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2020-25768

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.

VectorNETWORK

PublishedOct 07, 2020, 21:15

Published Bycve@mitre.org

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

contao/core-bundle(Packagist)4.0.04.4.52N/A

contao/core-bundle(Packagist)4.5.04.9.6N/A

contao/contao(Packagist)4.0.04.4.52N/A

contao/contao(Packagist)4.5.04.9.6N/A

contao/contao(Packagist)4.10.04.10.1N/A

contao/core-bundle(Packagist)4.10.04.10.1N/A

References

https://community.contao.org/en/forumdisplay.php?4-Announcements
https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html

Weakness Type

CWE-20

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK