CVE-2024-28235

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-28235
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler Vendor Advisory
https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler Vendor Advisory
https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129 Product
https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129 Product
https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16 Patch
https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16 Patch
https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d Patch
https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d Patch
https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr Vendor Advisory
https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*
cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*
History

17 Jan 2025, 15:42

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
References () https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129 - () https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129 - Product
References () https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d - () https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d - Patch
References () https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr - () https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr - Vendor Advisory
References () https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16 - () https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16 - Patch
References () https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler - () https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler - Vendor Advisory
First Time Contao
Contao contao
CPE cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo

09 Apr 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-09 16:15

Updated : 2025-01-17 15:42

NVD link : CVE-2024-28235

Mitre link : CVE-2024-28235

JSON object : View

Products Affected

contao

  • contao
CWE
NVD-CWE-noinfo