Security readout for executives and security teams
Plain-English summary
CVE-2021-35955 is a backend cross-site scripting issue in Contao. Malicious HTML attributes entered into an HTML field could run script in a backend user’s browser. The public bundle names fixed versions, but does not provide CVSS, CWE, proof of exploitation, or detailed impact.
Executive priority
Treat this as a moderate-priority CMS maintenance issue. It is not listed as actively exploited in the provided data, but backend XSS can affect administrator trust and session safety, so exposed Contao systems should be upgraded promptly.
Technical view
Contao versions from 4.0.0 are described as allowing backend XSS through HTML attributes in an HTML field. The record says fixes are available in 4.4.56, 4.9.18, and 4.11.7. No CVSS vector, CWE mapping, or exploit details are provided in the supplied sources.
Likely exposure
Likely exposure is Contao installations on affected 4.x versions below the stated fixed releases. Risk depends on who can create or edit backend HTML fields and who later views that content in the backend.
Exploitation context
The bundle does not show known active exploitation, and CISA KEV status is false. Practical abuse would require a path to place malicious HTML attributes into the relevant backend HTML field and have a backend user render it.
Researcher notes
The source bundle is sparse: no CVSS, CWE, affected CPEs, or exploit evidence are included. Analysis should stay focused on Contao backend HTML field handling and the fixed versions named by the CVE record.
Mitigation direction
- Upgrade Contao to 4.4.56, 4.9.18, 4.11.7, or later supported releases.
- Check the GitHub advisory and Contao guidance for version-specific upgrade notes.
- Restrict backend access to trusted users until affected systems are upgraded.
- Review backend editor roles that can modify HTML fields.
Validation and detection
- Inventory Contao versions across public and internal deployments.
- Confirm no instance remains below the fixed 4.4.56, 4.9.18, or 4.11.7 releases.
- Identify backend roles with permission to edit HTML fields.
- Review recent backend content changes for unexpected HTML attributes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-35955 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://contao.org/en/news/contao-4-9-16-and-4-11-5-are-available.htmlCVE reference · x_refsource_MISC
- https://github.com/contao/contao/security/advisories/GHSA-hr3h-x6gq-rqcpCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.