CVE-2024-28191 json
Contao may have unencoded insert tags in the frontend
published 2024-04-09 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1135 , GHSA-747v-52c4-8vj8
- cvss
- 3.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
Patch / fix
- packagist contao/core-bundle 4.13.40, 5.3.4
- contao contao 4.13.40, 5.3.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | contao/core-bundle | >=4.0.0, <4.13.40 >=5.0.0-RC1, <5.3.4 |
4.13.40 5.3.4 |
Affected products
- contao contao
Classification
- Weakness
-
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
-
github.com
/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919
web, patch
-
github.com
/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b
web, patch
-
github.com
/contao/contao/security/advisories/GHSA-747v-52c4-8vj8
web, vendor-advisory
-
contao.org
/en/security-advisories/insert-tag-injection-via-the-form-generator
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-28191
advisory
-
github.com
/contao/contao
package
Sources
- CVE List CVE-2024-28191
- GitHub Advisory GHSA-747v-52c4-8vj8
- NVD CVE-2024-28191
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.