Cross site scripting via input unit widget
Impact
Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview (back end) and on the website (front end).
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 4.0.0 before 4.9.42Ecosystem versions | 4.9.42 |
| From 4.10.0 before 4.13.28Ecosystem versions | 4.13.28 |
| From 5.0.0 before 5.1.10Ecosystem versions | 5.1.10 |
Version evidence: OSV · GHSA-4gpr-p634-922x
View original version evidence (284 explicit versions)
Original source description
Impact
Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview (back end) and on the website (front end).
Patches
Update to Contao 4.9.42, 4.13.28 or 5.1.10.
Workarounds
Disable login for all untrusted back end users.
References
https://contao.org/en/security-advisories/cross-site-scripting-in-widgets-with-units
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Credits
Thanks to Christian Pöschl and Fabian Brenner from usd AG for reporting this vulnerability.
References
- Security advisory github.com/contao/contao/security/advisories/GHSA-4gpr-p634-922x
- Security advisory nvd.nist.gov/vuln/detail/CVE-2023-36806
- Patch github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4
- Patch github.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82b
- Patch github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80e915d37cd32
- Source reference github.com/contao/contao
- Security advisory herolab.usd.de/security-advisories/usd-2023-0020