CVE-2023-36806

描述

### Impact Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview (back end) and on the website (front end). ### Patches Update to Contao 4.9.42, 4.13.28 or 5.1.10. ### Workarounds Disable login for all untrusted back end users. ### References https://contao.org/en/security-advisories/cross-site-scripting-in-widgets-with-units ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose). ### Credits Thanks to Christian Pöschl and Fabian Brenner from usd AG for reporting this vulnerability.

如何修補 CVE-2023-36806

要修補 CVE-2023-36806,請將受影響套件升級到下列已修補版本。

• —升級至 4.9.42 或更新版本

CVE-2023-36806 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 4.0.0, < 4.9.42

CVSS 分數

參考連結(7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-36806
• PATCHgithub.com/contao/contao
• WEBgithub.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4
• WEBgithub.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82b