GHSA-jc43-qrrp-98f5medium5.3
Insert tag injection in the Contao login module
Impact
It is possible to inject insert tags into the login module which will be replaced when the page is rendered.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
contao/core-bundle Packagist
| Affected range | Recorded fix |
|---|---|
| From 4.8.4 before 4.8.6Ecosystem versions | 4.8.6 |
Version evidence: OSV · GHSA-jc43-qrrp-98f5
View original version evidence (2 explicit versions)
contao/contao Packagist
| Affected range | Recorded fix |
|---|---|
| From 4.8.4 before 4.8.6Ecosystem versions | 4.8.6 |
Version evidence: OSV · GHSA-jc43-qrrp-98f5
View original version evidence (2 explicit versions)
Original source description
Impact
It is possible to inject insert tags into the login module which will be replaced when the page is rendered.
Patches
Update to Contao 4.8.6.
Workarounds
None.
References
https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
References
- Security advisory github.com/contao/contao/security/advisories/GHSA-jc43-qrrp-98f5
- Security advisory nvd.nist.gov/vuln/detail/CVE-2019-19714
- Security advisory contao.org/en/security-advisories/insert-tag-injection-in-the-login-module.html
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19714.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19714.yaml
- Source reference github.com/contao/contao