Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via a delete action in the user module, (2) delete news via a delete action in the news module, or (3) delete newsletters via a delete action in the newsletters module.

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.

Impact

If BBCode is enabled for comments, users can inject CSS styles.

Patches

Update to Contao 4.13.40 or 5.3.4.

Workarounds

Disable BBCode for comments.

References

https://contao.org/en/security-advisories/insufficient-bbcode-sanitization

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php in a (1) teachers.html or (2) teachers/ action.