cve-2024-45398
Vulnerability from cvelistv5
Published
2024-09-17 19:56
Modified
2024-09-18 13:17
Severity ?
EPSS score ?
Summary
Remote command execution through file upload in contao/core-bundle
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:contao:contao:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "contao",
"vendor": "contao",
"versions": [
{
"lessThanOrEqual": "4.13.49",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.3.15",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.4.3",
"status": "affected",
"version": "5.4.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T13:14:03.501932Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T13:17:36.013Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "contao",
"vendor": "contao",
"versions": [
{
"status": "affected",
"version": "\u003e=4.0.0, \u003c 4.13.49"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.3.15"
},
{
"status": "affected",
"version": "\u003e= 5.4.0, \u003c 5.4.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does not execute PHP files and other scripts in the Contao file upload directory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T19:56:00.791Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/contao/contao/security/advisories/GHSA-vm6r-j788-hjh5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/contao/contao/security/advisories/GHSA-vm6r-j788-hjh5"
},
{
"name": "https://contao.org/en/security-advisories/remote-command-execution-through-file-uploads",
"tags": [
"x_refsource_MISC"
],
"url": "https://contao.org/en/security-advisories/remote-command-execution-through-file-uploads"
}
],
"source": {
"advisory": "GHSA-vm6r-j788-hjh5",
"discovery": "UNKNOWN"
},
"title": "Remote command execution through file upload in contao/core-bundle"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-45398",
"datePublished": "2024-09-17T19:56:00.791Z",
"dateReserved": "2024-08-28T20:21:32.802Z",
"dateUpdated": "2024-09-18T13:17:36.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-45398\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-09-17T20:15:04.670\",\"lastModified\":\"2024-09-25T19:20:52.527\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does not execute PHP files and other scripts in the Contao file upload directory.\"},{\"lang\":\"es\",\"value\":\"Contao es un CMS de c\u00f3digo abierto. En las versiones afectadas, un usuario de back-end con acceso al administrador de archivos puede cargar archivos maliciosos y ejecutarlos en el servidor. Se recomienda a los usuarios que actualicen a Contao 4.13.49, 5.3.15 o 5.4.3. A los usuarios que no puedan actualizar se les recomienda que configuren su servidor web para que no ejecute archivos PHP y otros scripts en el directorio de carga de archivos de Contao.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\",\"baseScore\":8.3,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.5}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-434\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.13.49\",\"matchCriteriaId\":\"CB4C5DCC-94CE-4732-8B71-0CB60FFF3B31\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0.0\",\"versionEndExcluding\":\"5.3.15\",\"matchCriteriaId\":\"44942DC5-6564-4F2B-9C2F-EA446C70E05F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.0\",\"versionEndExcluding\":\"5.4.3\",\"matchCriteriaId\":\"BB66A97A-A8FA-4D3A-8E93-6692772217AC\"}]}]}],\"references\":[{\"url\":\"https://contao.org/en/security-advisories/remote-command-execution-through-file-uploads\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/contao/contao/security/advisories/GHSA-vm6r-j788-hjh5\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.