CVE-2021-35955: XSS
Impact
It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview (back end) and on the website (front end).
Installations are only affected if there are untrusted back end users who have the rights to modify HTML fields (e.g. TinyMCE).
Patches
Update to Contao 4.4.56, 4.9.18 or 4.11.7
Workarounds
Disable all fields that allow HTML for untrusted back end users or disable the login for these users.
References
https://contao.org/en/security-advisories/cross-site-scripting-via-html-attributes-in-the-back-end
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Credits
Thanks to Mikhail Khramenkov and Moritz Vondano for reporting this security issue.
Other sources
Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.
Cross site scripting via HTML attributes in the back end
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-35955?
CVE-2021-35955 has a high severity due to its potential for cross-site scripting attacks via HTML attributes.
How do I fix CVE-2021-35955?
To fix CVE-2021-35955, upgrade to Contao version 4.4.56, 4.9.18, or 4.11.7.
What impact does CVE-2021-35955 have on my application?
CVE-2021-35955 allows untrusted users to inject malicious code that could be executed on both the back end and front end of the application.
Which versions of Contao are affected by CVE-2021-35955?
CVE-2021-35955 affects Contao versions from 4.0.0 to 4.4.56, 4.5.0 to 4.9.18, and 4.10.0 to 4.11.7.
Are there specific user permissions that lead to CVE-2021-35955?
CVE-2021-35955 is primarily a risk when there are untrusted back end users with rights to modify HTML attributes.