{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-03T14:49:29.678","vulnerabilities":[{"cve":{"id":"CVE-2024-28235","sourceIdentifier":"security-advisories@github.com","published":"2024-04-09T16:15:07.863","lastModified":"2025-01-17T15:42:02.050","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed  options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages."},{"lang":"es","value":"Contao es un sistema de gestión de contenidos de código abierto. A partir de la versión 4.9.0 y antes de las versiones 4.13.40 y 5.3.4, al comprobar si hay enlaces rotos en páginas protegidas, Contao también envía el encabezado de la cookie a URL externas; las opciones pasadas para el cliente http se utilizan para todas las solicitudes. . Las versiones 4.13.40 y 5.3.4 de Contao tienen un parche para este problema. Como workaround, desactive el rastreo de páginas protegidas."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.0","versionEndExcluding":"4.13.40","matchCriteriaId":"A6D0092B-6633-4781-A177-8D962CD55916"},{"vulnerable":true,"criteria":"cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.3.4","matchCriteriaId":"556D1F95-B80C-4819-BFC2-CF3EF735BBE6"}]}]}],"references":[{"url":"https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e04164581145a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"]},{"url":"https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/contao/contao/commit/79b7620d01ce8f46ce2b331455e0d95e5208de3d","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}