Description

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

Remediation

References

CVE-2019-19712

Related Vulnerabilities

CKEditor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-9440)

WordPress Plugin Simple Security Multiple Cross-Site Scripting Vulnerabilities (1.1.5)

PHP Other Vulnerability (CVE-2007-1777)

WordPress Multiple Cross-Site Scripting Vulnerabilities (2.0 - 2.0.1)

WordPress Plugin Venture Event Manager Cross-Site Scripting (3.2.4)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-276 CVE-2019-19712