CVE-2021-37627
First published: Wed Aug 11 2021(Updated: )
### Impact It is possible for untrusted users to gain administrator rights with the form generator. Installations are only affected if there are untrusted back end users with access to the form generator. ### Patches Update to Contao 4.4.56, 4.9.18 or 4.11.7. ### Workarounds Disable the form generator or disable the login for untrusted back end users. ### References https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/contao/contao | >=4.0.0<4.4.56>=4.5.0<4.6.0>=4.6.0<4.7.0>=4.7.0<4.8.0>=4.8.0<4.9.0>=4.9.0<4.9.18>=4.10.0<4.11.0>=4.11.0<4.11.7 | |
| composer/contao/core-bundle | >=4.0.0<4.4.56>=4.5.0<4.6.0>=4.6.0<4.7.0>=4.7.0<4.8.0>=4.8.0<4.9.0>=4.9.0<4.9.18>=4.10.0<4.11.0>=4.11.0<4.11.7 | |
| Contao Contao | >=4.4.0<4.4.56 | |
| Contao Contao | >=4.9.0<4.9.18 | |
| Contao Contao | >=4.11.0<4.11.7 | |
| Contao Contao | =4.0.0 | |
| Contao Contao | =4.1.0 | |
| Contao Contao | =4.2.0 | |
| Contao Contao | =4.3.0 | |
| Contao Contao | =4.5.0 | |
| Contao Contao | =4.6.0 | |
| Contao Contao | =4.7.0 | |
| Contao Contao | =4.8.0 | |
| Contao Contao | =4.10.0 | |
| composer/contao/contao | >=4.10.0<4.11.7 | 4.11.7 |
| composer/contao/contao | >=4.5.0<4.9.18 | 4.9.18 |
| composer/contao/contao | >=4.0.0<4.4.56 | 4.4.56 |
| composer/contao/core-bundle | >=4.10.0<4.11.7 | 4.11.7 |
| composer/contao/core-bundle | >=4.5.0<4.9.18 | 4.9.18 |
| composer/contao/core-bundle | >=4.0.0<4.4.56 | 4.4.56 |
| >=4.4.0<4.4.56 | ||
| >=4.9.0<4.9.18 | ||
| >=4.11.0<4.11.7 | ||
| =4.0.0 | ||
| =4.1.0 | ||
| =4.2.0 | ||
| =4.3.0 | ||
| =4.5.0 | ||
| =4.6.0 | ||
| =4.7.0 | ||
| =4.8.0 | ||
| =4.10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator.html
- https://github.com/contao/contao/security/advisories/GHSA-hq5m-mqmx-fw6m
- https://nvd.nist.gov/vuln/detail/CVE-2021-37627
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2021-37627.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2021-37627.yaml
- https://github.com/advisories/GHSA-hq5m-mqmx-fw6m (Advisory)
Frequently Asked Questions
What is CVE-2021-37627?
CVE-2021-37627 is a vulnerability in Contao CMS that allows for privilege escalation in the Contao back end through the form generator.
How does CVE-2021-37627 affect Contao CMS?
CVE-2021-37627 affects Contao CMS installations if they have untrusted back end users who have access to the form generator.
What is the severity of CVE-2021-37627?
CVE-2021-37627 has a severity rating of 7.2 (high).
How can I fix CVE-2021-37627?
To fix CVE-2021-37627, you should update Contao CMS to a version beyond the affected range.
Where can I find more information about CVE-2021-37627?
More information about CVE-2021-37627 can be found at the following links: [Contao Security Advisories](https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator.html) and [GitHub Security Advisory](https://github.com/contao/contao/security/advisories/GHSA-hq5m-mqmx-fw6m).
- collector/friends-of-php
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-hq5m-mqmx-fw6m
- alias/CVE-2021-37627
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/severity
- agent/description
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- package-manager/composer
- vendor/contao
- canonical/contao contao
- version/contao contao/4.4.0
- version/contao contao/4.9.0
- version/contao contao/4.11.0
- version/contao contao/4.0.0
- version/contao contao/4.1.0
- version/contao contao/4.2.0
- version/contao contao/4.3.0
- version/contao contao/4.5.0
- version/contao contao/4.6.0
- version/contao contao/4.7.0
- version/contao contao/4.8.0
- version/contao contao/4.10.0