CVE-2024-45604

Summary

Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

Affected Software

Weaknesses

• CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/contao/contao/security/advisories/GHSA-4p75-5p53-65m9
• https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget

• ←Previous
• Next→