CVE-2019-19712

medium

Description

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

References

https://github.com/advisories/GHSA-4mvc-qc5w-v5qr

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0776

https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html

https://contao.org/en/news.html

Details

Source: Mitre, NVD

Published: 2019-12-17

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N