Vulnerability Description
Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Contao | Contao | >= 4.5.0, < 4.9.16 |
Related Weaknesses (CWE)
References
- https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-logVendor Advisory
- https://github.com/contao/contao/security/advisories/GHSA-h58v-c6rf-g9f7Third Party Advisory
- https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-logVendor Advisory
- https://github.com/contao/contao/security/advisories/GHSA-h58v-c6rf-g9f7Third Party Advisory
FAQ
What is CVE-2021-35210?
CVE-2021-35210 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system ...
How severe is CVE-2021-35210?
CVE-2021-35210 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-35210?
Check the references section above for vendor advisories and patch information. Affected products include: Contao Contao.