Skip to content

Cross site scripting via HTML attributes in the back end

Moderate
leofeyer published GHSA-hr3h-x6gq-rqcp Aug 11, 2021

Package

composer contao/core-bundle (Composer)

Affected versions

>=4.0.0

Patched versions

4.4.56, 4.9.18, 4.11.7

Description

Impact

It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview (back end) and on the website (front end).

Installations are only affected if there are untrusted back end users who have the rights to modify HTML fields (e.g. TinyMCE).

Patches

Update to Contao 4.4.56, 4.9.18 or 4.11.7

Workarounds

Disable all fields that allow HTML for untrusted back end users or disable the login for these users.

References

https://contao.org/en/security-advisories/cross-site-scripting-via-html-attributes-in-the-back-end

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

Credits

Thanks to Mikhail Khramenkov and Moritz Vondano for reporting this security issue.

Severity

Moderate
5.9
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

CVE ID

CVE-2021-35955

Weaknesses

No CWEs

Credits