GHSA-9jq2-jvwc-p52f

Source

https://github.com/advisories/GHSA-9jq2-jvwc-p52f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-9jq2-jvwc-p52f/GHSA-9jq2-jvwc-p52f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9jq2-jvwc-p52f

Aliases

CVE-2012-4383

Published

2022-04-23T00:40:39Z

Modified

2024-04-25T23:28:37.737584Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Contao core SQL Injection Vulnerability

Details

Contao core prior to 2.11.4 has a SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php

Database specific

{
    "nvd_published_at": "2020-01-29T15:15:00Z",
    "cwe_ids": [
        "CWE-89"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-25T23:04:44Z"
}

References

Affected packages

Packagist / contao/core

Package

Name: contao/core
Purl: pkg:composer/contao/core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.11.4

Affected versions

2.*

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.6.7

2.6.8

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.7.6

2.7.7

2.8.RC1

2.8.RC2

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.9.RC1

2.9.0

2.9.1

2.9.2

2.9.3

2.9.4

2.9.5

2.10.beta1

2.10.RC1

2.10.0

2.10.1

2.10.2

2.10.3

2.10.4

2.11.RC1

2.11.RC2

2.11.0

2.11.1

2.11.2

2.11.3