Description

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

Remediation

References

CVE-2019-19714

Related Vulnerabilities

Apache 2.x version older than 2.0.49

IBM RTC Inadequate Encryption Strength Vulnerability (CVE-2017-1701)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-2201)

Joomla! Core 3.x.x Cross-Site Request Forgery (3.7.0 - 3.9.18)

WordPress Plugin Elementor Website Builder Cross-Site Scripting (2.9.13)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-116 CVE-2019-19714