CVE-2019-11512: SQL Injection
Published Apr 30, 2019
·Updated
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.
Other sources
David Wind, penetration tester with A1 Digital, has discovered that the SQL injection vulnerability originally published under CVE-2017-16558 can still be exploited in the file manager in Contao 4.
— GitHub
SQL injection vulnerabililty in the file manager search filter
Affected Software
8 affected componentsFixes available
composer/contao/core-bundle>=4.1.0, <4.4.39, >=4.5.0, <4.6.0, >=4.6.0, <4.7.0, >=4.7.0, <4.7.5
composer/contao/contao>=4.1.0, <4.4.39, >=4.5.0, <4.6.0, >=4.6.0, <4.7.0, >=4.7.0, <4.7.5
composer/contao/core-bundle>=4.5.0<4.7.5
4.7.5
composer/contao/core-bundle>=4.1.0<4.4.39
4.4.39
composer/contao/contao>=4.5.0<4.7.5
4.7.5
composer/contao/contao>=4.1.0<4.4.39
4.4.39
Contao Contao>=4.0.0<4.4.39
Contao Contao>=4.5.0<4.7.5
Event History
Apr 30, 2019
Advisory Published
09:20 AM
Jul 9, 2019
CVE Published
via MITRE·08:33 PM
Data Sourced
via MITRE·08:33 PM
Description
Frequently Asked Questions
1
What is CVE-2019-11512?
CVE-2019-11512 is a SQL injection vulnerability in Contao 4.x.
2
What is the severity of CVE-2019-11512?
CVE-2019-11512 has a severity level of 9.8 (Critical).
3
How does CVE-2019-11512 affect Contao?
CVE-2019-11512 affects Contao versions from 4.1.0 to 4.7.5.
4
How can I fix CVE-2019-11512?
CVE-2019-11512 can be fixed by upgrading Contao to version 4.4.39 or 4.7.5.
5
Where can I find more information about CVE-2019-11512?
You can find more information about CVE-2019-11512 at https://contao.org/en/news/security-vulnerability-cve-2019-11512.html.