CVE-2024-45398
unknown
CVSS v3
—
CVSS v2
—
VIR risk
—
Description
Contao affected by remote command execution through file upload
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Packagist | contao/core-bundle | >=4.0.0,<4.13.49 | 4.13.49 |
| Packagist | contao/core-bundle | >=5.0.0,<5.3.15 | 5.3.15 |
| Packagist | contao/core-bundle | >=5.4.0,<5.4.3 | 5.4.3 |
References
- https://github.com/contao/contao/security/advisories/GHSA-vm6r-j788-hjh5
- https://nvd.nist.gov/vuln/detail/CVE-2024-45398
- https://github.com/contao/contao/commit/9445d509f12a7f1b68a4794dcc5e3e459b363ebb
- https://github.com/contao/contao/commit/a7e39f96ac8fdc281f7caaa96e01deb0e24ac7d3
- https://github.com/contao/contao/commit/f3db59ffe5a6c0e1f705b3230ebd5ff16865280e
- https://contao.org/en/security-advisories/remote-command-execution-through-file-uploads
- https://github.com/contao/contao
Verify integrity in audit chain (admin only). AS-IS.