CVE-2020-25768: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
(updated )
Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.
References
- community.contao.org/en/forumdisplay.php?4-Announcements
- contao.org/en/security-advisories/insert-tag-injection-in-forms.html
- github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2020-25768.yaml
- github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2020-25768.yaml
- github.com/advisories/GHSA-f7wm-x4gw-6m23
- github.com/contao/contao/security/advisories/GHSA-f7wm-x4gw-6m23
- nvd.nist.gov/vuln/detail/CVE-2020-25768
Code Behaviors & Features
Detect and mitigate CVE-2020-25768 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →