Description

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.

Remediation

References

CVE-2017-10993

Related Vulnerabilities

MySQL CVE-2023-22104 Vulnerability (CVE-2023-22104)

WordPress Plugin WordPress File Upload Directory Traversal (4.12.2)

MySQL CVE-2016-0642 Vulnerability (CVE-2016-0642)

phpBB Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-5502)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-4309)

Severity

High

Classification

CVE-2017-10993 CWE-22 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities