Contao: Possible cookie sharing with external domains while checking protected pages for broken links

中 6.5CVE-2024-28235 · GHSA-9jh5-qf84-x6pr · 09/04/2024 公開 · 17/06/2026 更新

要点

CVE-2024-28235 は contao/core-bundle, contao (contao) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.71%（全脆弱性の 53.5% より高い）。
対処：4.13.40, 5.3.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
contao/core-bundle Packagist	`≥ 4.9.0, < 4.13.40≥ 5.0.0-RC1, < 5.3.4`	`4.13.405.3.4`
contao contao	`≥ 4.9.0, < 4.13.40≥ 5.0.0, < 5.3.4`	`4.13.405.3.4`

概要

Impact

If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs.

Patches

Update to Contao 4.13.40 or 5.3.4.

Workarounds

Disable crawling protected pages.

References

https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

NVD の説明

Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.