{"action":"Upgrade contao/contao to 4.4.8 or later.","affected":[{"introduced":"3.0.0","last_affected":"3.5.30"},{"fixed":"4.4.8","introduced":"4.0.0"}],"component":"contao/contao","cve_ids":["CVE-2017-16558"],"ecosystem":"Packagist","epss":0.01506,"exploited":false,"fixed_versions":["4.4.8"],"ghsa_id":"GHSA-w38g-hj45-mjjp","id":"tcs_01M5KF9NYYFY3NNC5CEQ7Y02MA","modified_at":"2024-04-25T23:28:37.961403Z","published_at":"2022-05-24T16:44:36Z","references":["https://osv.dev/vulnerability/GHSA-w38g-hj45-mjjp","https://nvd.nist.gov/vuln/detail/CVE-2017-16558","https://github.com/contao/contao/commit/501cb3cd34d61089b94e7ed78da53977bc71fc3e","https://github.com/contao/contao/commit/6b4a2711edf166c85cfd7a53fed6aea56d4f0544","https://contao.org/de/changelog/versions/4.4.html","https://contao.org/en/news/contao-4_4_8.html","https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2017-16558.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2017-16558.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/listing-bundle/CVE-2017-16558.yaml","https://github.com/contao/contao/blob/4.4.57/CHANGELOG.md#448-2017-11-15"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-w38g-hj45-mjjp","url":"https://osv.dev/vulnerability/GHSA-w38g-hj45-mjjp"}],"summary":"Contao SQL injection in the backend and listing module"}