« Volver al listado

CVE-2019-19745

Estado: ModificadaAlta (8.8)—

Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Contao — Contao

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-19745",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-12-17T15:15:25.957",
  "references": [
    {
      "url": "https://contao.org/en/news.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://contao.org/en/security-advisories/unrestricted-file-uploads.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://contao.org/en/news.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://contao.org/en/security-advisories/unrestricted-file-uploads.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server."
    },
    {
      "lang": "es",
      "value": "Contao versiones 4.0 hasta 4.8.5, permite una inclusión de archivos locales PHP. Un usuario del back-end con acceso al generador de formularios puede cargar archivos arbitrarios y ejecutarlos sobre el servidor."
    }
  ],
  "lastModified": "2026-06-17T02:27:10.853",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1AD2B857-54C5-4BC8-9D46-37EEE783D1A3",
              "versionEndIncluding": "4.4.45",
              "versionStartIncluding": "4.4"
            },
            {
              "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC371563-77B0-4C5F-A66C-E03C64C3779B",
              "versionEndIncluding": "4.8.5",
              "versionStartIncluding": "4.8"
            },
            {
              "criteria": "cpe:2.3:a:contao:contao:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DE7216A-3486-47CA-8D7F-1E65DB974A32"
            },
            {
              "criteria": "cpe:2.3:a:contao:contao:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94C28910-F081-4039-AED5-BA41135B663A"
            },
            {
              "criteria": "cpe:2.3:a:contao:contao:4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5A04634-8F66-4147-8175-DA09A57B3F4A"
            },
            {
              "criteria": "cpe:2.3:a:contao:contao:4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "022613D3-B240-479B-A3F5-A6459044A483"
            },
            {
              "criteria": "cpe:2.3:a:contao:contao:4.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D63B7ED-B2FA-46A2-9471-ED363182F318"
            },
            {
              "criteria": "cpe:2.3:a:contao:contao:4.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA76FF3F-26FB-46B8-8179-D0E4985CA98C"
            },
            {
              "criteria": "cpe:2.3:a:contao:contao:4.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6495BA2-DB3D-4877-93A7-13C0ABC0B291"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}