CVE-2017-10993
21.07.2017, 06:29
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.
| Vendor | Product | Version |
|---|---|---|
| contao | contao_cms | 𝑥 ≤ 3.5.27 |
| contao | contao_cms | 4.0.0 |
| contao | contao_cms | 4.0.0:beta1 |
| contao | contao_cms | 4.0.0:rc1 |
| contao | contao_cms | 4.0.1 |
| contao | contao_cms | 4.0.2 |
| contao | contao_cms | 4.0.3 |
| contao | contao_cms | 4.0.4 |
| contao | contao_cms | 4.1.0 |
| contao | contao_cms | 4.1.0:beta1 |
| contao | contao_cms | 4.1.0:rc1 |
| contao | contao_cms | 4.1.1 |
| contao | contao_cms | 4.1.2 |
| contao | contao_cms | 4.1.3 |
| contao | contao_cms | 4.2.0 |
| contao | contao_cms | 4.2.0:beta1 |
| contao | contao_cms | 4.2.0:rc1 |
| contao | contao_cms | 4.2.1 |
| contao | contao_cms | 4.2.2 |
| contao | contao_cms | 4.2.3 |
| contao | contao_cms | 4.2.4 |
| contao | contao_cms | 4.2.5 |
| contao | contao_cms | 4.3.0 |
| contao | contao_cms | 4.3.0:rc1 |
| contao | contao_cms | 4.3.1 |
| contao | contao_cms | 4.3.2 |
| contao | contao_cms | 4.3.3 |
| contao | contao_cms | 4.3.5 |
| contao | contao_cms | 4.3.6 |
| contao | contao_cms | 4.3.7 |
| contao | contao_cms | 4.3.8 |
| contao | contao_cms | 4.3.9 |
| contao | contao_cms | 4.3.10 |
| contao | contao_cms | 4.3.11 |
| contao | contao_cms | 4.4.0 |
| contao | contao_cms | 4.4.0:beta1 |
| contao | contao_cms | 4.4.0:rc1 |
| contao | contao_cms | 4.4.0:rc2 |
𝑥
= Vulnerable software versions