CVE-2024-28191: Contao may have unencoded insert tags in the frontend
Impact
It is possible to inject insert tags via the form generator if the submitted form data is output on the page in a specific way.
Patches
Update to Contao 4.13.40 or 5.3.4.
Workarounds
Do not output the submitted form data on the website.
References
https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Other sources
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28191?
CVE-2024-28191 has a severity rating that indicates a potential risk of injected tags via the form generator.
How do I fix CVE-2024-28191?
To fix CVE-2024-28191, update to Contao version 4.13.40 or 5.3.4.
What should I avoid to mitigate CVE-2024-28191?
To mitigate CVE-2024-28191, avoid outputting submitted form data on the website.
Which versions of Contao are affected by CVE-2024-28191?
CVE-2024-28191 affects all Contao versions prior to 4.13.40 and 5.3.4.
Is there a workaround for CVE-2024-28191?
Yes, the workaround for CVE-2024-28191 is to not output submitted form data on the page.