Security readout for executives and security teams
Plain-English summary
A Contao CMS bug lets a logged-in backend user with specific editing rights inject malicious code into headline or input-unit fields. That code can execute in admin previews and on public pages. Risk is moderate and mainly matters where backend access is shared with contractors, editors, or other untrusted users.
Executive priority
Treat this as a prompt CMS maintenance item, not an emergency unless untrusted backend users exist. Prioritize shared-editor, agency-managed, or customer-administered Contao sites because public page integrity and admin session safety may be affected.
Technical view
CVE-2023-36806 is a CWE-79 cross-site scripting issue in Contao 4.0.0 through unfixed 4.9, 4.13, and 5.1 branches. The vulnerable input unit widget allows untrusted backend users to place executable content in headline-related fields. Fixed versions are 4.9.42, 4.13.28, and 5.1.10.
Likely exposure
Exposure is limited to Contao installations before 4.9.42, 4.13.28, or 5.1.10 where untrusted backend users can modify headline fields or other fields using the input unit widget.
Exploitation context
The source bundle reports no KEV listing and provides no evidence of active exploitation. Exploitation requires authenticated backend privileges and user interaction, but successful injection can affect both the backend preview context and the public website.
Researcher notes
The advisory scope is specific: Contao, backend users, headline fields, and other input unit widget fields. The provided sources identify patched versions and a temporary access-control workaround, but do not provide public exploitation evidence or broader product impact.
Mitigation direction
- Upgrade Contao to 4.9.42, 4.13.28, 5.1.10, or a later supported release.
- Disable login for untrusted backend users until patched.
- Review backend roles with headline or input-unit field editing permissions.
- Follow Contao vendor guidance for branch-specific update requirements.
Validation and detection
- Inventory Contao versions across production, staging, and managed customer sites.
- Confirm whether backend users outside trusted staff can edit headline or input-unit fields.
- Verify installed Contao version is at or above the fixed release for its branch.
- Review recent content edits by lower-trust backend accounts for suspicious changes.
- Confirm public pages and backend previews render sanitized content after update.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-36806 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L2.33.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/contao/contao/security/advisories/GHSA-4gpr-p634-922xCVE reference · x_refsource_CONFIRM
- https://github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4CVE reference · x_refsource_MISC
- https://github.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82bCVE reference · x_refsource_MISC
- https://github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80e915d37cd32CVE reference · x_refsource_MISC
- https://herolab.usd.de/security-advisories/usd-2023-0020/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.