Contao affected by directory traversal in the file selector widget
### Impact Back end users can list files outside their file mounts or the document root in the FileSelector widget. ### Patches Update to Contao 4.13.49. ### Workarounds None. ### References https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose). ### Credits Thanks to Jakob Steeg from usd AG for reporting this vulnerability.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-45604US | medium4.3 | — | ||
Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to up… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widgetWEB
- https://github.com/contao/contaoPACKAGE
- https://github.com/contao/contao/commit/63409c6bdfd95197d9906e229d765b630d45742eWEB
- https://github.com/contao/contao/security/advisories/GHSA-4p75-5p53-65m9WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-45604ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan