[{"vendor":"contao","product":"contao","defaultStatus":"unknown","cpes":["cpe:2.3:a:contao:contao:5.4.1:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.1","status":"affected"}]}]

{"timestamp":"2024-10-02T20:29:10.374330Z","id":"CVE-2024-45965","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Contao","product":"Contao","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.13.54","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.3.30","versionType":"semver","status":"affected"},{"version":"5.4.0","lessThan":"5.5.6","versionType":"semver","status":"affected"}]}]

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

CWE-79

OR
          *cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:* versions from (including) 4.0 up to (excluding) 4.13.54
          *cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:* versions from (including) 5.0.0 up to (excluding) 5.3.30
          *cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:* versions from (including) 5.4.0 up to (excluding) 5.5.6

MITRE: https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads Types: Vendor Advisory

MITRE: https://grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb Types: Exploit, Third Party Advisory

Contao 5.4.1 allows an authenticated admin account to upload a SVG file containing malicious javascript code into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted javascript to the target.

Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE-434

https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads

CISA-ADP AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

CISA-ADP CWE-79

Contao 5.4.1 allows an authenticated admin account to upload a SVG file containing malicious javascript code into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted javascript to the target.

MITRE https://grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb [No types assigned]