CVE-2024-28235 - CVE House
Back to Database
Status published High CVE-2024-28235

Contao possible cookie sharing with external domains while checking protected pages for broken links

Vulnerability Description

Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-28235

Credits & Attribution

No credits recorded in the NVD database.

References

More from contao

View All →
CVE-2025-65961
Contao is vulnerable to cross-site scripting in templates
Low 3.3
CVE-2025-65960
Contao is vulnerable to remote code execution in template closures
Medium 6.6
CVE-2025-57759
Contao has improper privilege management for page and article fields
Medium 4.3
CVE-2025-57758
Contao has improper access control in the back end voters
Medium 4.3
CVE-2025-57757
Contao discloses information in the news module
Medium 5.3

Affected Vendor

Affected Software

contao
Vulnerable Versions:
>= 4.9.0, < 4.13.40, >= 5.0.0-RC1, < 5.3.4

Timeline

Official Publish: April 9th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration