Medium severity · published May 26, 2017
CVE-2015-0269
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the…
4.3
CVSS
2.1%
EPSS
No
On KEV
Description
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Contao Cms · Contao
through 3.2.18; 3.4.0; 3.4.0; 3.4.1; 3.4.2; 3.4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0269
Vendor Advisory
https://contao.org/en/news/contao-3_2_19.html
Vendor Advisory
https://contao.org/en/news/contao-3_4_4.html
Vendor Advisory
https://contao.org/en/news/directory-traversal-vulnerability-cve-2015-0269.html
More from Contao Cms
9.8
CVE-2014-1860
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities
9.8
CVE-2017-16558
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module
9.8
CVE-2019-10643
Contao 4.7 allows Use of a Key Past its Expiration Date
9.8
CVE-2019-10641
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password
8.8
CVE-2019-10642
Contao 4.7 allows CSRF