CVE-2023-36806
1 advisory.
Packagist/contao/core-bundle CVE-2023-36806: medium 6.6
Cross site scripting via input unit widget
Action: Upgrade contao/core-bundle to 4.9.42 or later.
composer require contao/core-bundle:4.9.42composer require contao/core-bundle:4.13.28composer require contao/core-bundle:5.1.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.9.42 | - |
| 4.10.0 | 4.13.28 | - |
| 5.0.0 | 5.1.10 | - |
Fixed versions
| 4.9.42 | 4.13.28 | 5.1.10 |
Sources
- osv: GHSA-4gpr-p634-922x
- https://github.com/contao/contao/security/advisories/GHSA-4gpr-p634-922x
- https://nvd.nist.gov/vuln/detail/CVE-2023-36806
- https://github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4
- https://github.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82b
- https://github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80e915d37cd32
- https://github.com/contao/contao
- https://herolab.usd.de/security-advisories/usd-2023-0020
CVE-2023-36806 · published · modified · JSON