CVE-2024-28235
mediumpriority · track · 26EPSS 0.007 · 53 %ileEUUSEPSS · scored 2026-10-27
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6–8.4
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-9jh5-qf84-x6prContao: Possible cookie sharing with external domains while checking protected pages for broken links2024-04-09ghsa · osvUS
### Impact If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs. ### Patches Update to Contao 4.13.40 or 5.3.4. ### Workarounds Disable crawling protected pages. ### References https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (16)
External citations — patches, advisories, analysis.
- https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawlercnnvd
- https://cxsecurity.com/cveshow/CVE-2024-28235/cnnvd
- https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129cnnvd
- https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16cnnvd
- https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3dcnnvd
- https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6prcnnvd
- https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawlerenisa_euvd
- https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan