5.3

CVE-2019-19712

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Contao ≫ Contao Version >= 4.4.0 <= 4.4.45
Contao ≫ Contao Version >= 4.8 <= 4.8.5
Contao ≫ Contao Version4.0
Contao ≫ Contao Version4.1
Contao ≫ Contao Version4.2
Contao ≫ Contao Version4.3
Contao ≫ Contao Version4.5
Contao ≫ Contao Version4.6
Contao ≫ Contao Version4.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.88% 0.543
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://contao.org/en/news.html
Vendor Advisory
Release Notes
https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html
Vendor Advisory