要点
- CVE-2024-28190 は contao/core-bundle, contao (contao) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.50%（全脆弱性の 43.0% より高い）。
- 対処：4.13.40, 5.3.4 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| contao/core-bundle Packagist | ≥ 4.0.0, < 4.13.40≥ 5.0.0-RC1, < 5.3.4
| 4.13.405.3.4
|
| contao | ≥ 4.0.0, < 4.13.40≥ 5.0.0, < 5.3.4
| 4.13.405.3.4
|
概要
Impact
Users can insert malicious code into file names when uploading files, which is then executed in tooltips and popups in the backend.
Patches
Update to Contao 4.13.40 or Contao 5.3.4.
Workarounds
Disable uploads for untrusted users.
References
https://contao.org/en/security-advisories/cross-site-scripting-in-the-file-manager
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Credits
Thanks to Alexander Wuttke for reporting this vulnerability.
NVD の説明
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン