medium4.3Public exploit code
CVE-2011-4335
Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ContaoCMS 2.10.1 - Cross-Site Scripting2011-10-02 · webapps · php · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php in a (1) teachers.html or (2) teachers/ action.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Contao | Contao Cms | through 2.10.1 Versions 2.0, 2.1.0, 2.1.1, 2.1.2, 2.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://dev.contao.org/projects/typolight/repository/revisions/1041
- http://openwall.com/lists/oss-security/2011/11/21/30
- http://openwall.com/lists/oss-security/2011/11/22/1
- http://www.rul3z.de/advisories/SSCHADV2011-025.txt
- http://www.securityfocus.com/archive/1/520046/100/0/threaded
- http://dev.contao.org/projects/typolight/repository/revisions/1041
- http://openwall.com/lists/oss-security/2011/11/21/30
- http://openwall.com/lists/oss-security/2011/11/22/1
- http://www.rul3z.de/advisories/SSCHADV2011-025.txt
- http://www.securityfocus.com/archive/1/520046/100/0/threaded