Cross-Site Scripting Vulnerabilities in Contao by Contao GmbH
CVE-2011-4335

Currently unrated

Key Information:

Vendor: Contao
Status: Contao Cms
Vendor: CVE Published:; 28 November 2011

What is CVE-2011-4335?

Contao, a content management system, has been identified to have multiple vulnerabilities that allow remote attackers to exploit the application through cross-site scripting (XSS). Specifically, malicious scripts or HTML can be injected through the PATH_INFO variable in HTTP requests sent to index.php, particularly targeting the teachers.html and teachers/ actions in versions prior to 2.10.2. This could potentially lead to unauthorized actions being performed within the user’s session, thereby compromising the security integrity of the application.

References

http://www.securityfocus.com/archive/1/520046/100/0/threaded

mailing-listx_refsource_BUGTRAQ

http://openwall.com/lists/oss-security/2011/11/21/30

mailing-listx_refsource_MLIST

http://dev.contao.org/projects/typolight/repository/revis...

x_refsource_CONFIRM

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 28, 2011
Vulnerability Reserved
Nov 4, 2011

CVE-2011-4335 Data

JSON