GHSA-w38g-hj45-mjjp
Suggest an improvement- Source
- https://github.com/advisories/GHSA-w38g-hj45-mjjp
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w38g-hj45-mjjp/GHSA-w38g-hj45-mjjp.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-w38g-hj45-mjjp
- Aliases
- Published
- 2022-05-24T16:44:36Z
- Modified
- 2024-04-25T23:28:37.961403Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Contao SQL injection in the backend and listing module
- Details
-
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the backend as well as in the listing module.
- Database specific
{ "nvd_published_at": "2019-04-25T17:29:00Z", "cwe_ids": [ "CWE-89" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-04-25T23:08:50Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2017-16558
- https://github.com/contao/contao/commit/501cb3cd34d61089b94e7ed78da53977bc71fc3e
- https://github.com/contao/contao/commit/6b4a2711edf166c85cfd7a53fed6aea56d4f0544
- https://contao.org/de/changelog/versions/4.4.html
- https://contao.org/en/news/contao-4_4_8.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2017-16558.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2017-16558.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/listing-bundle/CVE-2017-16558.yaml
- https://github.com/contao/contao/blob/4.4.57/CHANGELOG.md#448-2017-11-15
Affected packages
Packagist / contao/contao
Package
- Name
- contao/contao
- Purl
- pkg:composer/contao/contao
Packagist / contao/contao
Package
- Name
- contao/contao
- Purl
- pkg:composer/contao/contao
Packagist / contao/core-bundle
Package
- Name
- contao/core-bundle
- Purl
- pkg:composer/contao/core-bundle
Affected versions
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0-beta1
4.1.0-RC1
4.1.0
4.1.1
4.1.2
4.1.3
4.2.0-beta1
4.2.0-RC1
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0-RC1
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.3.10
4.3.11
4.4.0-beta1
4.4.0-RC1
4.4.0-RC2
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
Packagist / contao/listing-bundle
Package
- Name
- contao/listing-bundle
- Purl
- pkg:composer/contao/listing-bundle
Packagist / contao/core-bundle
Package
- Name
- contao/core-bundle
- Purl
- pkg:composer/contao/core-bundle
Packagist / contao/listing-bundle
Package
- Name
- contao/listing-bundle
- Purl
- pkg:composer/contao/listing-bundle