GHSA-j55w-hjpj-825gmedium4.3
Contao: Insufficient BBCode sanitizer
Impact
If BBCode is enabled for comments, users can inject CSS styles.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
contao/comments-bundle Packagist
| Affected range | Recorded fix |
|---|---|
| From 2.0.0 before 4.13.40Ecosystem versions | 4.13.40 |
| From 5.0.0-RC1 before 5.3.4Ecosystem versions | 5.3.4 |
Version evidence: OSV · GHSA-j55w-hjpj-825g
View original version evidence (328 explicit versions)
Original source description
Impact
If BBCode is enabled for comments, users can inject CSS styles.
Patches
Update to Contao 4.13.40 or 5.3.4.
Workarounds
Disable BBCode for comments.
References
https://contao.org/en/security-advisories/insufficient-bbcode-sanitization
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
References
- Security advisory github.com/contao/contao/security/advisories/GHSA-j55w-hjpj-825g
- Security advisory nvd.nist.gov/vuln/detail/CVE-2024-28234
- Patch github.com/contao/contao/commit/55b995d8d35da0d36bc6a22c53fe6423ab0c4ae2
- Patch github.com/contao/contao/commit/6d42e667177c972ae7c219645593c262d7764ce2
- Security advisory contao.org/en/security-advisories/insufficient-bbcode-sanitization
- Source reference github.com/contao/contao