CVE-2018-10125: XSS
Published Apr 18, 2018
·Updated
Contao before 4.5.7 has XSS in the system log.
Other sources
Cross-site scripting (XSS) vulnerability in the system log of the back end
Affected Software
16 affected componentsFixes available
composer/contao/core-bundle>=4.0.0, <4.4.18, >=4.5.0, <4.5.8
composer/contao/core>=3.0.0, <3.5.35
composer/contao/contao>=4.0.0, <4.4.18, >=4.5.0, <4.5.8
composer/contao/core-bundle>=3.0.0<3.5.35
3.5.35
composer/contao/core>=3.0.0<3.5.35
3.5.35
composer/contao/core-bundle>=4.5.0<4.5.8
4.5.8
composer/contao/core-bundle>=4.0.0<4.4.18
4.4.18
composer/contao/contao>=4.5.0<4.5.8
4.5.8
composer/contao/contao>=4.0.0<4.4.18
4.4.18
Contao Contao>=3.0.0<=3.5.33
Contao Contao>=4.4.0<=4.4.16
Contao Contao>=4.5.0<=4.5.6
Contao Contao=4.0.0
Contao Contao=4.1.0
Contao Contao=4.2.0
Contao Contao=4.3.0
Event History
Apr 18, 2018
Advisory Published
09:29 AM
Mar 16, 2020
CVE Published
via MITRE·02:40 PM
Data Sourced
via MITRE·02:40 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-10125?
CVE-2018-10125 has a medium severity level due to its Cross-site Scripting (XSS) vulnerability.
2
How do I fix CVE-2018-10125?
To fix CVE-2018-10125, upgrade to Contao versions 4.5.8, 4.4.18, or 3.5.35.
3
Which versions of Contao are affected by CVE-2018-10125?
CVE-2018-10125 affects Contao versions from 3.0.0 to 3.5.35 and from 4.0.0 to 4.5.7.
4
What type of vulnerability is CVE-2018-10125?
CVE-2018-10125 is a Cross-site Scripting (XSS) vulnerability located in the system log of the backend.
5
Is CVE-2018-10125 a remote exploit vulnerability?
CVE-2018-10125 can potentially be exploited remotely due to the nature of XSS vulnerabilities.