CVE-2019-19712 Information disclosure in the Contao backend

What is CVE-2019-19712?

CVE-2019-19712 is a medium-severity missing authorization vulnerability in n/a, published on 17 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

Weakness: CWE-276

Which versions are affected by CVE-2019-19712?

8 open source packages ship an affected version, including contao/contao and contao/core-bundle. It affects 1 product.

Products include Contao Contao.

How do I fix CVE-2019-19712?

Upgrade contao/contao to a fixed version for your release line: 4.4.46 or 4.8.6.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-19712 being exploited?

There is no known exploitation of CVE-2019-19712 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-26265 Remote Code Execution in Contao Managed Edition Critical 9.8
• CVE-2019-11512 Contao SQL injection in the file manager Critical 9.8
• CVE-2012-4383 Contao core SQL Injection Vulnerability High 8.8
• CVE-2019-19745 Unrestricted file uploads in Contao High 8.8
• CVE-2024-28235 Contao possible cookie sharing with external domains while checking protected pages for broken links High 8.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4mvc-qc5w-v5qr.