CVE-2024-28234: Contao has insufficient BBCode sanitizer
Impact
If BBCode is enabled for comments, users can inject CSS styles.
Patches
Update to Contao 4.13.40 or 5.3.4.
Workarounds
Disable BBCode for comments.
References
https://contao.org/en/security-advisories/insufficient-bbcode-sanitization
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Other sources
Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28234?
CVE-2024-28234 is rated as a high severity vulnerability due to the potential for CSS injection in comments.
How do I fix CVE-2024-28234?
To fix CVE-2024-28234, update to Contao version 4.13.40 or 5.3.4.
What happens if I leave CVE-2024-28234 unpatched?
Leaving CVE-2024-28234 unpatched may allow unauthorized users to inject malicious CSS, compromising the integrity of your site.
Can I mitigate CVE-2024-28234 without updating?
Yes, you can mitigate CVE-2024-28234 by disabling BBCode for comments.
Which versions of Contao are affected by CVE-2024-28234?
CVE-2024-28234 affects Contao versions prior to 4.13.40 and 5.3.4.