contao/core PHP object injection vulnerability allows for arbitrary code execution

Description

References

• contao/core · WEB
• contao/core commit d67c46c · WEB
• contao/core commit f939b5b · WEB
• contao.org/en/news/major-security-hole-found-in-contao.html · WEB
• FriendsOfPHP/security-advisories · WEB

Weitere Schwachstellen in contao/core

• GHSA-wxxw-5gq6-j2g5KRITISCH 9.0contao/core Insufficient input validation allows for code injection and remote execution
• CVE-2018-5478MITTEL 6.1Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.
• CVE-2018-10125MITTEL 6.1Contao before 4.5.7 has XSS in the system log.
• CVE-2012-4383HOCH 8.8contao prior to 2.11.4 has a sql injection vulnerability
• CVE-2019-10641KRITISCH 9.8Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.