Critical severity · published Apr 25, 2019
CVE-2017-16558
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module
9.8
CVSS
1.5%
EPSS
No
On KEV
Description
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Contao Cms · Contao
3.0.0 through 3.5.30; 4.0.0 through 4.4.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-16558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-16558
Vendor Advisory
https://contao.org/de/changelog/versions/4.4.html
Vendor Advisory
https://contao.org/en/news/contao-4_4_8.html
More from Contao Cms
9.8
CVE-2014-1860
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities
9.8
CVE-2019-10643
Contao 4.7 allows Use of a Key Past its Expiration Date
9.8
CVE-2019-10641
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password
8.8
CVE-2019-10642
Contao 4.7 allows CSRF
8.8
CVE-2017-10993
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal