Path to this page:
Subject: CVS commit: pkgsrc/www/contao35
From: Takahiro Kambe
Date: 2018-04-23 16:00:18
Message id: 20180423140018.22B22FBEC@cvs.NetBSD.org
Log Message:
www/contao35: update to 3.5.35
Version 3.5.35 (2018-04-18)
---------------------------
### Fixed
Fix an XSS vulnerability in the system log (see CVE-2018-10125).
CVE-2018-10125
With a manipulated request, an attacker can implant a script which is executed
when a logged in back end user opens the system log. The attacker themselves
does not have to be logged in.
The problem affects Contao 3.0.0 to 3.5.34, 4.0.0 to 4.4.17 and 4.5.0 to
4.5.7. We highly recommend you to update.
Files: