CVE-2023-36806
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Contao is an open source content management system. In versions from 4.0.0 to 4.9.42, 4.13.28, and 5.1.10, untrusted backend users can inject malicious code into headline fields, which will be executed both in the element preview and on the website.
Risk Assessment
Organizations are at risk if they have untrusted backend users with rights to modify headline fields, potentially leading to the execution of malicious code on the site.
Recommendation
It is recommended to install patches in versions 4.9.42, 4.13.28, and 5.1.10 or temporarily disable login for all untrusted backend users.
Original NVD description (English source)
Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.