Contao: Insufficient BBCode sanitizer

MEDIO 4.7CVE-2024-28234 · GHSA-j55w-hjpj-825g · Published 09/04/2024 · updated 17/06/2026

In breve

CVE-2024-28234 è una vulnerabilità MEDIO (CVSS 4.7) che riguarda contao/comments-bundle, contao (contao).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.57%, superiore al 47.3% delle vulnerabilità.
Correzione: aggiornare a 4.13.40, 5.3.4 o successiva.

Package	Affected versions	Patched versions
contao/comments-bundle Packagist	`≥ 2.0.0, < 4.13.40≥ 5.0.0-RC1, < 5.3.4`	`4.13.405.3.4`
contao contao	`≥ 2.0, < 4.13.40≥ 5.0.0, < 5.3.4`	`4.13.405.3.4`

Description

Impact

If BBCode is enabled for comments, users can inject CSS styles.

Patches

Update to Contao 4.13.40 or 5.3.4.

Workarounds

Disable BBCode for comments.

References

https://contao.org/en/security-advisories/insufficient-bbcode-sanitization

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

NVD description

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.

References

contao/contao security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-28234 · ADVISORY
contao/contao commit 55b995d · WEB
contao/contao commit 6d42e66 · WEB
contao.org/en/security-advisories/insufficient-bbcode-sanitization · WEB
contao/contao · PACKAGE

Altre vulnerabilità di contao/comments-bundle

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

contao/comments-bundle

Packagist

≥ 2.0.0, < 4.13.40≥ 5.0.0-RC1, < 5.3.4

4.13.405.3.4

contao

≥ 2.0, < 4.13.40≥ 5.0.0, < 5.3.4

4.13.405.3.4

Description

Impact

If BBCode is enabled for comments, users can inject CSS styles.

Patches

Update to Contao 4.13.40 or 5.3.4.

Workarounds

Disable BBCode for comments.

References

https://contao.org/en/security-advisories/insufficient-bbcode-sanitization

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

NVD description