CVE-2019-19712 — Incorrect Default Permissions in Contao

CWE-276 — Incorrect Default Permissions4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 67.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ContaoContao Core-bundle
Timeline
PublishedDec 17

Description

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶Packagistcontao/contao4.0.0 — 4.4.46+1
▶Packagistcontao/core-bundle4.0.0 — 4.4.46+1
▶NVDcontao/contao4.4.0 — 4.4.45+8

🔴Vulnerability Details

3
CVEList
CVE-2019-19712: Contao 4↗2019-12-17
▶
GHSA
Information disclosure in the Contao backend↗2019-12-17
▶
OSV
Information disclosure in the Contao backend↗2019-12-17
▶
CVE-2019-19712 — Incorrect Default Permissions | cvebase