Skip to content

Cross site scripting via input unit widget

Moderate severity GitHub Reviewed Published Jul 25, 2023 in contao/contao • Updated Nov 15, 2023

Package

composer contao/core-bundle (Composer)

Affected versions

>= 4.0.0, < 4.9.42
>= 4.10.0, < 4.13.28
>= 5.0.0, < 5.1.10

Patched versions

4.9.42
4.13.28
5.1.10

Description

Impact

Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview (back end) and on the website (front end).

Patches

Update to Contao 4.9.42, 4.13.28 or 5.1.10.

Workarounds

Disable login for all untrusted back end users.

References

https://contao.org/en/security-advisories/cross-site-scripting-in-widgets-with-units

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

Credits

Thanks to Christian Pöschl and Fabian Brenner from usd AG for reporting this vulnerability.

References

@leofeyer leofeyer published to contao/contao Jul 25, 2023
Published to the GitHub Advisory Database Jul 25, 2023
Reviewed Jul 25, 2023
Published by the National Vulnerability Database Jul 25, 2023
Last updated Nov 15, 2023

Severity

Moderate
6.6
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Weaknesses

CVE ID

CVE-2023-36806

GHSA ID

GHSA-4gpr-p634-922x

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.