Contao Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2017-10993)

Description

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.

Remediation

References

CVE-2017-10993

Related Vulnerabilities

WordPress Plugin User Registration, Login & Landing Pages-LeadMagic Cross-Site Scripting (1.2.7)

WordPress Plugin WP Private Content Plus Cross-Site Request Forgery (3.1)

WordPress Plugin SecureMoz Security Audit PHP Object Injection (1.0.5)

ATutor Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2017-1000002)

Undertow Uncontrolled Resource Consumption Vulnerability (CVE-2019-19343)

Severity

High

Classification

CVE-2017-10993 CWE-22 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H