Security advisories

Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.

2019

Insert tag injection in the login module

2019-12-17 09:29 by Leo Feyer

Date: 2019-12-17
CVE ID: CVE-2019-19714

It is possible to inject insert tags into the login module which will be replaced when the page is rendered. The problem affects Contao 4.8.4 and 4.8.5 and has been fixed in Contao 4.8.6.

Information disclosure in the back end

2019-12-17 08:53 by Leo Feyer

Date: 2019-12-17
CVE ID: CVE-2019-19712

Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. The problem affects all Contao versions as of Contao 4.0 and has been fixed in Contao 4.4.46 and 4.8.6.

Unrestricted file uploads

2019-12-17 08:17 by Leo Feyer

Date: 2019-12-17
CVE ID: CVE-2019-19745

A back end user with access to the form generator can upload arbitrary files and execute them on the server. The problem affects all Contao versions as of Contao 4.0 and has been fixed in Contao 4.4.46 and 4.8.6.

SQL injection in the file manager

2019-04-30 08:32 by Leo Feyer

Date: 2019-04-30
CVE ID: CVE-2019-11512

The search menu of the file manager is vulnerable to SQL injections. The problem affects all Contao versions as of Contao 4.1 and has been fixed in Contao 4.4.39 and 4.7.5.

Invalidating opt-in tokens

2019-04-09 12:21 by Leo Feyer

Date: 2019-04-09
CVE ID: CVE-2019-10643

Confirming an opt-in token does not invalidate previous opt-in tokens. The problem affects Contao 4.7 and has been fixed in Contao 4.7.3.

Read more … Invalidating opt-in tokens

Bypassing the request token check

2019-04-09 12:20 by Leo Feyer

Date: 2019-04-09
CVE ID: CVE-2019-10642

The request token check can be bypassed. The problem affects Contao 4.7 and has been fixed in Contao 4.7.3.

Session invalidation upon password changes

2019-04-09 10:44 by Leo Feyer

Date: 2019-04-09
CVE ID: CVE-2019-10641

User sessions are not invalidated if a user changes their password. The problem affects all Contao versions and has been fixed in Contao 3.5.39, 4.4.37 and 4.7.3.