« Volver al listado

CVE-2024-45612

Estado: AnalizadaMedia (5.3)—

Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Contao — Contao

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45612",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45612",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-18T14:06:58.302616Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "contao",
          "product": "contao",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.13.0, < 4.13.49"
            },
            {
              "status": "affected",
              "version": ">= 5.0.0, < 5.3.15"
            },
            {
              "status": "affected",
              "version": ">= 5.4.0, < 5.4.3"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*"
          ],
          "vendor": "contao",
          "product": "contao",
          "versions": [
            {
              "status": "affected",
              "version": "4.13.0",
              "lessThan": "4.13.49",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "5.0.0",
              "lessThan": "5.3.15",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "5.4.0",
              "lessThan": "5.4.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-17T19:15:28.250",
  "references": [
    {
      "url": "https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings."
    },
    {
      "lang": "es",
      "value": "Contao es un CMS de código abierto. En las versiones afectadas, un usuario no confiable puede insertar etiquetas de inserción en la etiqueta canónica, que luego se reemplazan en la página web (interfaz). Se recomienda a los usuarios que actualicen a Contao 4.13.49, 5.3.15 o 5.4.3. Los usuarios que no puedan actualizar deben deshabilitar las etiquetas canónicas en la configuración de la página raíz."
    }
  ],
  "lastModified": "2026-06-17T07:54:33.890",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "654C764D-CA76-404D-8D37-FCD94B38C980",
              "versionEndExcluding": "4.13.49",
              "versionStartIncluding": "4.13.0"
            },
            {
              "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81742BA9-7293-4F0A-87B6-AEB4618143E6",
              "versionEndExcluding": "5.3.15",
              "versionStartIncluding": "5.3.0"
            },
            {
              "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB66A97A-A8FA-4D3A-8E93-6692772217AC",
              "versionEndExcluding": "5.4.3",
              "versionStartIncluding": "5.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}