Vulnerability Description
Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does not execute PHP files and other scripts in the Contao file upload directory.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Contao | Contao | >= 4.0.0, < 4.13.49 |
Related Weaknesses (CWE)
References
- https://contao.org/en/security-advisories/remote-command-execution-through-file-Vendor Advisory
- https://github.com/contao/contao/security/advisories/GHSA-vm6r-j788-hjh5Third Party Advisory
FAQ
What is CVE-2024-45398?
CVE-2024-45398 is a vulnerability with a CVSS score of 8.3 (HIGH). Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13...
How severe is CVE-2024-45398?
CVE-2024-45398 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-45398?
Check the references section above for vendor advisories and patch information. Affected products include: Contao Contao.