Security readout for executives and security teams
Plain-English summary
Contao CMS 3.x before 3.5.32 has a cross-site scripting issue in the frontend newsletter unsubscribe module. If that module is exposed, an attacker could potentially make a user’s browser run attacker-controlled script in the site context. Public sources do not provide a CVSS score or confirm active exploitation.
Executive priority
Treat this as a targeted legacy CMS cleanup item. It is not supported by active-exploitation evidence, but exposed XSS on a public website can create user trust, session, and brand risk.
Technical view
The disclosed issue is XSS in Contao core affecting 3.x releases before 3.5.32, specifically through the frontend newsletter extension unsubscribe module. The bundle provides no CWE, CVSS vector, payload details, or root-cause analysis. The practical exposure question is whether an organization runs an affected Contao version with that frontend module reachable.
Likely exposure
Likely limited to organizations still running legacy Contao 3.x installations below 3.5.32, especially public sites using the newsletter unsubscribe frontend module.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not claim active exploitation. Public evidence supports an XSS vulnerability and fixed version boundary, but not exploitation prevalence.
Researcher notes
The source bundle is sparse: it establishes the product family, version boundary, and XSS location, but not CVSS, CWE, exploit maturity, or implementation details. Avoid exploit reproduction; prioritize version verification, route exposure, and upgrade validation.
Mitigation direction
- Identify any Contao 3.x installations and confirm the deployed core version.
- Upgrade Contao core to 3.5.32 or later using vendor-supported guidance.
- Check whether the frontend newsletter unsubscribe module is enabled and publicly reachable.
- Temporarily restrict or disable the affected newsletter path if upgrade timing creates unacceptable risk.
- Review vendor and package advisories for supported migration options from legacy Contao 3.x.
Validation and detection
- Inventory package manifests, lockfiles, and deployed CMS metadata for contao/core versions below 3.5.32.
- Confirm whether the newsletter unsubscribe frontend module exists on public routes.
- Review web logs for unusual unsubscribe requests or suspicious script-like parameters.
- After remediation, verify the deployed version is 3.5.32 or later.
- Run safe web application regression checks focused on newsletter unsubscribe behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-5478 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.