CVE-2021-35210
Last modified
CVE-2021-35210 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end.. EPSS estimates a 0.74% chance of exploitation in the next 30 days.
Description
Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Contao | Contao | >= 4.5.0, < 4.9.16 |
| Contao | Contao | >= 4.10.0, < 4.11.5 |
References
- https://github.com/contao/contao/security/advisories/GHSA-h58v-c6rf-g9f7Third Party Advisory
- https://github.com/contao/contao/security/advisories/GHSA-h58v-c6rf-g9f7Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-35210?
How severe is CVE-2021-35210?
How do I fix CVE-2021-35210?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-35205NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows …5.4
- CVE-2021-35206Gitpod before 0.6.0 allows unvalidated redirects.6.1
- CVE-2021-35207An issue was discovered in Zimbra Collaboration Suite 8.8 be…6.1
- CVE-2021-35208An issue was discovered in ZmMailMsgView.js in the Calendar …5.4
- CVE-2021-35209An issue was discovered in ProxyServlet.java in the /proxy s…9.8
- CVE-2021-3521There is a flaw in RPM's signature functionality. OpenPGP su…4.7
- CVE-2021-35211Microsoft discovered a remote code execution (RCE) vulnerabi…10
- CVE-2021-35212An SQL injection Privilege Escalation Vulnerability was disc…8.8
- CVE-2021-35213An Improper Access Control Privilege Escalation Vulnerabilit…8.8
- CVE-2021-35214The vulnerability in SolarWinds Pingdom can be described as …4.7
- CVE-2021-35215Insecure deserialization leading to Remote Code Execution wa…8.8
- CVE-2021-35216Insecure Deserialization of untrusted data remote code execu…8.8
Are you affected by CVE-2021-35210?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST