CVE-2024-28235
1 advisory.
Packagist/contao/core-bundle CVE-2024-28235: high 8.3
Contao: Possible cookie sharing with external domains while checking protected pages for broken links
Action: Upgrade contao/core-bundle to 4.13.40 or later.
composer require contao/core-bundle:4.13.40composer require contao/core-bundle:5.3.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.9.0 | 4.13.40 | - |
| 5.0.0-RC1 | 5.3.4 | - |
Fixed versions
| 4.13.40 | 5.3.4 |
Sources
- osv: GHSA-9jh5-qf84-x6pr
- https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr
- https://nvd.nist.gov/vuln/detail/CVE-2024-28235
- https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16
- https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d
- https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler
- https://github.com/contao/contao
- https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129
CVE-2024-28235 · published · modified · JSON