Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-45604

Date: September 17, 2024

Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

Language: PHP

Severity Score

Related Resources (6)

https://nvd.nist.gov/vuln/detail/CVE-2024-45604
https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget
https://github.com/contao/contao
https://github.com/contao/contao/commit/63409c6bdfd95197d9906e229d765b630d45742e
https://github.com/contao/contao/security/advisories/GHSA-4p75-5p53-65m9
https://www.mend.io/vulnerability-database/CVE-2024-45604

Severity Score

Weakness Type (CWE)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us