Main Vulnerability Database Vulnerabilities #VU55862

#VU55862 Code Injection in Contao - CVE-2021-37626

Published: August 16, 2021

Vulnerability identifier: #VU55862

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2021-37626

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Contao

Software vendor:
Contao

Description

The vulnerability allows a remote local to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote administrator can load PHP files and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.