CVE-2024-28235

Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.

• CWE-200

• https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawlerVendor Advisory
• https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129Product
• https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16Patch
• https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3dPatch
• https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6prVendor Advisory
• https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawlerVendor Advisory
• https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129Product
• https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16Patch
• https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3dPatch
• https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6prVendor Advisory

Published

Apr 9, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2823A vulnerability has been found in DedeCMS 5.7 and classified…4.3
• CVE-2024-28230In JetBrains YouTrack before 2024.1.25893 attaching/detachin…6.5
• CVE-2024-28231eprosima Fast DDS is a C++ implementation of the Data Distri…7.5
• CVE-2024-28232Go package IceWhaleTech/CasaOS-UserService provides user man…7.5
• CVE-2024-28233JupyterHub is an open source multi-user server for Jupyter n…6.1
• CVE-2024-28234Contao is an open source content management system. Starting…4.7
• CVE-2024-28236Vela is a Pipeline Automation (CI/CD) framework built on Lin…6.5
• CVE-2024-28237OctoPrint provides a web interface for controlling consumer …4.8
• CVE-2024-28238Directus is a real-time API and App dashboard for managing S…2.3
• CVE-2024-28239Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2024-2824A vulnerability was found in Matthias-Wandel jhead 3.08 and …6.3
• CVE-2024-28240The GLPI Agent is a generic management agent. A vulnerabilit…7.8