Description

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.

Remediation

References

CVE-2017-10993

Related Vulnerabilities

WordPress Plugin YouTube Embed Cross-Site Scripting (5.0.1)

WordPress Plugin Find My Blocks Information Disclosure (3.3.2)

Restlet Framework XML Injection (aka Blind XPath Injection) Vulnerability (CVE-2013-4221)

MongoDb Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2019-20924)

Moodle CVE-2019-3851 Vulnerability (CVE-2019-3851)

Severity

High

Classification

CVE-2017-10993 CWE-22 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities