CVE-2018-20028: Contao Information Disclosure via Access Control Flaws
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control.
Other sources
Contao Information Disclosure via Access Control Flaws
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/contao/contaoto a version that resolves this vulnerability.Fixed in 4.4.31 - Upgrade
Upgrade
composer/contao/contaoto a version that resolves this vulnerability.Fixed in 4.6.11 - Upgrade
Upgrade
composer/contao/contaoto a version that resolves this vulnerability.Fixed in 3.5.37
Event History
Frequently Asked Questions
What is the vulnerability ID for this Contao issue?
The vulnerability ID for this Contao issue is CVE-2018-20028.
What is the severity level of CVE-2018-20028?
CVE-2018-20028 has a severity level of medium (6.5).
What is the issue with Contao 3.x, 4.4.x, and 4.6.x versions?
Contao 3.x before 3.5.37, 4.4.x before 4.4.31, and 4.6.x before 4.6.11 have an Incorrect Access Control vulnerability.
How does the Incorrect Access Control vulnerability impact Contao CMS?
The Incorrect Access Control vulnerability in Contao CMS allows unauthorized access to restricted functionality.
How can I fix the Incorrect Access Control vulnerability in Contao CMS?
To fix the Incorrect Access Control vulnerability, update Contao CMS to version 3.5.37, 4.4.31, or 4.6.11 or later.