CVE-2024-28235 json
Contao possible cookie sharing with external domains while checking protected pages for broken links
published 2024-04-09 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1172 , GHSA-9jh5-qf84-x6pr
- cvss
- 8.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
Patch / fix
- packagist contao/core-bundle 4.13.40, 5.3.4
- contao contao 4.13.40, 5.3.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | contao/core-bundle | >=4.9.0, <4.13.40 >=5.0.0-RC1, <5.3.4 |
4.13.40 5.3.4 |
Affected products
- contao contao
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16
web, patch
-
github.com
/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d
web, patch
-
github.com
/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr
web, vendor-advisory
-
contao.org
/en/security-advisories/session-cookie-disclosure-in-the-crawler
web, vendor-advisory
-
github.com
/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.ph
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2024-28235
advisory
-
github.com
/contao/contao
package
Sources
- CVE List CVE-2024-28235
- GitHub Advisory GHSA-9jh5-qf84-x6pr
- NVD CVE-2024-28235
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.