GHSA-w38g-hj45-mjjpcritical9.8
Contao SQL injection in the backend and listing module
Impact
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the backend as well as in the listing module.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
contao/contao Packagist
| Affected range | Recorded fix |
|---|---|
| From 3.0.0 through 3.5.30 (inclusive)Ecosystem versions | Not recorded |
| From 4.0.0 before 4.4.8Ecosystem versions | 4.4.8 |
Version evidence: OSV · GHSA-w38g-hj45-mjjp
View original version evidence (0 explicit versions)
contao/core-bundle Packagist
| Affected range | Recorded fix |
|---|---|
| From 4.0.0 before 4.4.8Ecosystem versions | 4.4.8 |
| From 3.0.0 through 3.5.30 (inclusive)Ecosystem versions | Not recorded |
Version evidence: OSV · GHSA-w38g-hj45-mjjp
View original version evidence (43 explicit versions)
contao/listing-bundle Packagist
| Affected range | Recorded fix |
|---|---|
| From 4.0.0 before 4.4.8Ecosystem versions | 4.4.8 |
| From 3.0.0 through 3.5.30 (inclusive)Ecosystem versions | Not recorded |
Version evidence: OSV · GHSA-w38g-hj45-mjjp
View original version evidence (37 explicit versions)
Original source description
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the backend as well as in the listing module.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2017-16558
- Patch github.com/contao/contao/commit/501cb3cd34d61089b94e7ed78da53977bc71fc3e
- Patch github.com/contao/contao/commit/6b4a2711edf166c85cfd7a53fed6aea56d4f0544
- Release notes contao.org/de/changelog/versions/4.4.html
- Source reference contao.org/en/news/contao-4_4_8.html
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2017-16558.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2017-16558.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/contao/listing-bundle/CVE-2017-16558.yaml
- Release notes github.com/contao/contao/blob/4.4.57/CHANGELOG.md