CVE-2024-28235 Contao possible cookie sharing with external domains while checking protected pages for broken links

What is CVE-2024-28235?

CVE-2024-28235 is a high-severity vulnerability in contao, published on 9 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.

Weakness: CWE-200

Which versions are affected by CVE-2024-28235?

4 open source packages ship an affected version, including contao/core-bundle. It affects 1 product.

Products include Contao Contao.

How do I fix CVE-2024-28235?

Upgrade contao/core-bundle to a fixed version for your release line: 4.13.40 or 5.3.4.

Is CVE-2024-28235 being exploited?

There is no known exploitation of CVE-2024-28235 in the wild and no public exploit code.

Other vulnerabilities in contao

• CVE-2022-26265 Remote Code Execution in Contao Managed Edition Critical 9.8
• CVE-2019-11512 Contao SQL injection in the file manager Critical 9.8
• CVE-2012-4383 Contao core SQL Injection Vulnerability High 8.8
• CVE-2019-19745 Unrestricted file uploads in Contao High 8.8
• CVE-2024-45398 Remote command execution through file upload in contao/core-bundle High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9jh5-qf84-x6pr.