CVE-2011-4335: XSS
Published Nov 28, 2011
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php in a (1) teachers.html or (2) teachers/ action.
Affected Software
106 affected components
Contao Contao CMS=2.1.20
Contao Contao CMS=2.2.6
Contao Contao CMS=2.4.0
Contao Contao CMS=2.2.4
Contao Contao CMS=2.5.9
Contao Contao CMS=2.6.2
Contao Contao CMS=2.4.6
Contao Contao CMS=2.4.3
Contao Contao CMS=2.6.1
Contao Contao CMS=2.2.5
Contao Contao CMS=2.7.6
Contao Contao CMS=2.8.4
Contao Contao CMS=2.1.22
Contao Contao CMS=2.1.8
Contao Contao CMS=2.6.4
Contao Contao CMS=2.1.19
Contao Contao CMS=2.1.15
Contao Contao CMS=2.1.2
Contao Contao CMS=2.1.16
Contao Contao CMS=2.2.0
Contao Contao CMS=2.2.1
Contao Contao CMS<=2.10.1
Contao Contao CMS=2.3.4
Contao Contao CMS=2.1.0
Contao Contao CMS=2.7.0
Contao Contao CMS=2.1.11
Contao Contao CMS=2.8.3
Contao Contao CMS=2.2.11
Contao Contao CMS=2.0
Contao Contao CMS=2.5.0
Contao Contao CMS=2.8.1
Contao Contao CMS=2.9.4
Contao Contao CMS=2.5.5
Contao Contao CMS=2.4.5
Contao Contao CMS=2.7.1
Contao Contao CMS=2.2.12
Contao Contao CMS=2.5.7
Contao Contao CMS=2.10.0
Contao Contao CMS=2.9.1
Contao Contao CMS=2.5.6
Contao Contao CMS=2.7.5
Contao Contao CMS=2.7.7
Contao Contao CMS=2.9.0
Contao Contao CMS=2.1.17
Contao Contao CMS=2.9.5
Contao Contao CMS=2.6.8
Contao Contao CMS=2.0-beta-rc2
Contao Contao CMS=2.3.1
Contao Contao CMS=2.5.1
Contao Contao CMS=2.7.2
Contao Contao CMS=2.5.4
Contao Contao CMS=2.1.3
Contao Contao CMS=2.2.7
Contao Contao CMS=2.6.5
Contao Contao CMS=2.3.3
Contao Contao CMS=2.2.2
Contao Contao CMS=2.5.3
Contao Contao CMS=2.10.0-rc1
Contao Contao CMS=2.1.10
Contao Contao CMS=2.0-beta-rc3
Contao Contao CMS=2.5.2
Contao Contao CMS=2.8.0
Contao Contao CMS=2.1.13
Contao Contao CMS=2.1.9
Contao Contao CMS=2.2.10
Contao Contao CMS=2.4.2
Contao Contao CMS=2.1.14
Contao Contao CMS=2.1.6
Contao Contao CMS=2.2.9
Contao Contao CMS=2.1.5
Contao Contao CMS=2.6.7
Contao Contao CMS=2.7.4
Contao Contao CMS=2.1.21
Contao Contao CMS=2.3.2
Contao Contao CMS=2.8.2
Contao Contao CMS=2.1.1
Contao Contao CMS=2.4.7
Contao Contao CMS=2.3.0
Contao Contao CMS=2.1.4
Contao Contao CMS=2.1.18
Contao Contao CMS=2.6.0
Contao Contao CMS=2.7.3
Contao Contao CMS=2.4.4
Contao Contao CMS=2.9.3
Contao Contao CMS=2.4.1
Contao Contao CMS=2.0-beta-rc1
Contao Contao CMS=2.2.3
Contao Contao CMS=2.2.8
Contao Contao CMS=2.5.8
Contao Contao CMS=2.9.2
Contao Contao CMS=2.6.3
Contao Contao CMS=2.6.6
Contao Contao CMS=2.1.12
Contao Contao CMS=2.1.7
Contao Contao CMS=2.4.0-beta
Contao Contao CMS=2.5.0-beta
Contao Contao CMS=2.5.0-beta-rc2
Contao Contao CMS=2.8.0-rc2
Contao Contao CMS=2.9.0-beta1
Contao Contao CMS=2.9.0-rc1
Contao Contao CMS=2.10.0-beta1
Contao Contao CMS=2.6.0-beta
Contao Contao CMS=2.6.0-beta2
Contao Contao CMS=2.8.0-rc1
Contao Contao CMS=2.7.0-rc1
Contao Contao CMS=2.7.0-rc2
Event History
Nov 28, 2011
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-4335?
CVE-2011-4335 is classified as a medium severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2011-4335?
To fix CVE-2011-4335, upgrade Contao CMS to version 2.10.2 or later.
3
What versions of Contao are affected by CVE-2011-4335?
CVE-2011-4335 affects Contao versions prior to 2.10.2, including versions 2.0 to 2.10.1.
4
What are the potential impacts of CVE-2011-4335?
Exploitation of CVE-2011-4335 could allow remote attackers to execute arbitrary scripts in the context of the user's browser.
5
How does CVE-2011-4335 exploit XSS vulnerabilities?
CVE-2011-4335 exploits XSS vulnerabilities through the injection of arbitrary web script or HTML via the PATH_INFO in specific action endpoints.