CVE-2018-5478: XSS
Contao 3.x before 3.5.32 allows Cross-site Scripting (XSS) via the unsubscribe module in the frontend newsletter extension.
Other sources
Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.
XSS vulnerabililty in the front end "unsubscribe" module of the newsletter extension
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this XSS vulnerability?
The vulnerability ID for this XSS vulnerability is CVE-2018-5478.
What is the affected software for this vulnerability?
The affected software for this vulnerability is Contao 3.x before 3.5.32.
What is the severity level of CVE-2018-5478?
The severity level of CVE-2018-5478 is medium, with a severity value of 6.1.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by injecting malicious code through the unsubscribe module in the frontend newsletter extension.
Is there a fix available for CVE-2018-5478?
Yes, a fix is available for CVE-2018-5478. It is recommended to update Contao to version 3.5.32 or above.