CVE-2024-28235 (GCVE-0-2024-28235)
Vulnerability from cvelistv5
Published
2024-04-09 15:50
Modified
2024-08-02 00:48
Severity ?
8.3 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Summary
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
References
security-advisories@github.comhttps://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawlerVendor Advisory
security-advisories@github.comhttps://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129Product
security-advisories@github.comhttps://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16Patch
security-advisories@github.comhttps://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3dPatch
security-advisories@github.comhttps://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6prVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawlerVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129Product
af854a3a-2127-422b-91ae-364da2661108https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3dPatch
af854a3a-2127-422b-91ae-364da2661108https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6prVendor Advisory
Impacted products
Vendor Product Version
contao contao Version: >= 4.9.0, < 4.13.40
Version: >= 5.0.0-RC1, < 5.3.4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28235",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-10T19:31:57.807830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:03:52.358Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:48:49.584Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr"
          },
          {
            "name": "https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16"
          },
          {
            "name": "https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d"
          },
          {
            "name": "https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler"
          },
          {
            "name": "https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "contao",
          "vendor": "contao",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.9.0, \u003c 4.13.40"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-RC1, \u003c 5.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed  options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-09T15:50:56.531Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr"
        },
        {
          "name": "https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16"
        },
        {
          "name": "https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d"
        },
        {
          "name": "https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler"
        },
        {
          "name": "https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129"
        }
      ],
      "source": {
        "advisory": "GHSA-9jh5-qf84-x6pr",
        "discovery": "UNKNOWN"
      },
      "title": "Contao possible cookie sharing with external domains while checking protected pages for broken links"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-28235",
    "datePublished": "2024-04-09T15:50:56.531Z",
    "dateReserved": "2024-03-07T14:33:30.035Z",
    "dateUpdated": "2024-08-02T00:48:49.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-28235\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-04-09T16:15:07.863\",\"lastModified\":\"2025-01-17T15:42:02.050\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed  options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.\"},{\"lang\":\"es\",\"value\":\"Contao es un sistema de gesti\u00f3n de contenidos de c\u00f3digo abierto. A partir de la versi\u00f3n 4.9.0 y antes de las versiones 4.13.40 y 5.3.4, al comprobar si hay enlaces rotos en p\u00e1ginas protegidas, Contao tambi\u00e9n env\u00eda el encabezado de la cookie a URL externas; las opciones pasadas para el cliente http se utilizan para todas las solicitudes. . Las versiones 4.13.40 y 5.3.4 de Contao tienen un parche para este problema. Como workaround, desactive el rastreo de p\u00e1ginas protegidas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":8.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.0\",\"versionEndExcluding\":\"4.13.40\",\"matchCriteriaId\":\"A6D0092B-6633-4781-A177-8D962CD55916\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0.0\",\"versionEndExcluding\":\"5.3.4\",\"matchCriteriaId\":\"556D1F95-B80C-4819-BFC2-CF3EF735BBE6\"}]}]}],\"references\":[{\"url\":\"https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Contao possible cookie sharing with external domains while checking protected pages for broken links\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-200\", \"lang\": \"en\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.4, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr\"}, {\"name\": \"https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16\"}, {\"name\": \"https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d\"}, {\"name\": \"https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler\"}, {\"name\": \"https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129\"}], \"affected\": [{\"vendor\": \"contao\", \"product\": \"contao\", \"versions\": [{\"version\": \"\u003e= 4.9.0, \u003c 4.13.40\", \"status\": \"affected\"}, {\"version\": \"\u003e= 5.0.0-RC1, \u003c 5.3.4\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-04-09T15:50:56.531Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed  options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.\"}], \"source\": {\"advisory\": \"GHSA-9jh5-qf84-x6pr\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-28235\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-10T19:31:57.807830Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:23.008Z\"}, \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-28235\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2024-03-07T14:33:30.035Z\", \"datePublished\": \"2024-04-09T15:50:56.531Z\", \"dateUpdated\": \"2024-06-04T18:03:52.358Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.