Publish Advisories

GHSA-4r6g-xhx7-fm36 GHSA-j99g-qjvx-995g GHSA-4r6g-xhx7-fm36 GHSA-j99g-qjvx-995g
2026-05-22 18:04:22 -07:00 · 2024-04-25 23:16:10 +00:00
parent f0a6a274e5
commit a3a270543d
4 changed files with 189 additions and 88 deletions
@@ -0,0 +1,96 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4r6g-xhx7-fm36",
+  "modified": "2024-04-25T23:15:43Z",
+  "published": "2022-05-17T02:42:22Z",
+  "aliases": [
+    "CVE-2015-0269"
+  ],
+  "summary": "Contao Core directory traversal vulnerability",
+  "details": "Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated backend users to view files outside their file mounts or the document root via unspecified vectors.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "contao/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.4.0"
+            },
+            {
+              "fixed": "3.4.4"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "contao/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "3.2.19"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0269"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/contao/core/commit/0229e839b4849e402256b972eb62f89f2c29674d"
+    },
+    {
+      "type": "WEB",
+      "url": "https://contao.org/en/news/contao-3_2_19.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://contao.org/en/news/contao-3_4_4.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://contao.org/en/news/directory-traversal-vulnerability-cve-2015-0269.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2015-0269.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/contao/core"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-25T23:15:43Z",
+    "nvd_published_at": "2017-05-26T17:29:00Z"
+  }
+}
@@ -0,0 +1,93 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j99g-qjvx-995g",
+  "modified": "2024-04-25T23:15:07Z",
+  "published": "2022-05-13T01:07:57Z",
+  "aliases": [
+    "CVE-2019-10643"
+  ],
+  "summary": "Contao Does Not Expire Tokens Correctly",
+  "details": "Security researcher Ali Razzaq has discovered that confirming an opt-in token does not invalidate previous opt-in tokens in Contao 4.7.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "contao/contao"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.7.0"
+            },
+            {
+              "fixed": "4.7.3"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "contao/core-bundle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.7.0"
+            },
+            {
+              "fixed": "4.7.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10643"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/contao/contao/commit/70348cc812b110831ad66a4f9857883f75649b88"
+    },
+    {
+      "type": "WEB",
+      "url": "https://contao.org/en/news.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://contao.org/en/news/security-vulnerability-cve-2019-10643.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-10643.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-10643.yaml"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-287",
+      "CWE-324"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-25T23:15:07Z",
+    "nvd_published_at": "2019-04-17T19:29:00Z"
+  }
+}
@@ -1,46 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-4r6g-xhx7-fm36",
-  "modified": "2022-05-17T02:42:22Z",
-  "published": "2022-05-17T02:42:22Z",
-  "aliases": [
-    "CVE-2015-0269"
-  ],
-  "details": "Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated \"back end\" users to view files outside their file mounts or the document root via unspecified vectors.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0269"
-    },
-    {
-      "type": "WEB",
-      "url": "https://contao.org/en/news/contao-3_2_19.html"
-    },
-    {
-      "type": "WEB",
-      "url": "https://contao.org/en/news/contao-3_4_4.html"
-    },
-    {
-      "type": "WEB",
-      "url": "https://contao.org/en/news/directory-traversal-vulnerability-cve-2015-0269.html"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-22"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2017-05-26T17:29:00Z"
-  }
-}
@@ -1,42 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-j99g-qjvx-995g",
-  "modified": "2022-05-13T01:07:57Z",
-  "published": "2022-05-13T01:07:57Z",
-  "aliases": [
-    "CVE-2019-10643"
-  ],
-  "details": "Contao 4.7 allows Use of a Key Past its Expiration Date.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10643"
-    },
-    {
-      "type": "WEB",
-      "url": "https://contao.org/en/news.html"
-    },
-    {
-      "type": "WEB",
-      "url": "https://contao.org/en/news/security-vulnerability-cve-2019-10643.html"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-287"
-    ],
-    "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2019-04-17T19:29:00Z"
-  }
-}