Description

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.

Remediation

References

CVE-2017-10993

Related Vulnerabilities

MySQL CVE-2020-14654 Vulnerability (CVE-2020-14654)

Drupal Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-6926)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-5624)

WordPress Plugin Customify-Intuitive Website Styling Cross-Site Request Forgery (2.10.4)

Contao Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2024-45612)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-22 CVE-2017-10993