FKIE_CVE-2025-57759

Vulnerability from fkie_nvd - Published: 2025-08-28 17:15 - Updated: 2025-09-02 17:36
Severity
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.
References
security-advisories@github.comhttps://contao.org/en/security-advisories/improper-privilege-management-for-page-and-article-fieldsVendor Advisory
security-advisories@github.comhttps://github.com/contao/contao/commit/80ee7db12d55ad979d9b1b180f273d4e2668851fPatch
security-advisories@github.comhttps://github.com/contao/contao/security/advisories/GHSA-qqfq-7cpp-hcqjPatch, Third Party Advisory
Impacted products
Vendor Product Version
contao contao *
contao contao *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "33F26EC5-04D5-48B8-9633-63E661CE2103",
              "versionEndExcluding": "5.3.38",
              "versionStartIncluding": "5.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC84DCCC-B7C2-43DB-AFFA-F3464B640F78",
              "versionEndExcluding": "5.6.1",
              "versionStartIncluding": "5.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds."
    },
    {
      "lang": "es",
      "value": "Contao es un CMS de c\u00f3digo abierto. En versiones a partir de la 5.3.0 y anteriores a la 5.3.38 y la 5.6.1, bajo ciertas condiciones, los usuarios del *back end* podr\u00edan editar campos de p\u00e1ginas y art\u00edculos sin tener los permisos necesarios. Este problema ha sido parcheado en las versiones 5.3.38 y 5.6.1. No hay soluciones alternativas."
    }
  ],
  "id": "CVE-2025-57759",
  "lastModified": "2025-09-02T17:36:12.837",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-08-28T17:15:36.597",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://contao.org/en/security-advisories/improper-privilege-management-for-page-and-article-fields"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/contao/contao/commit/80ee7db12d55ad979d9b1b180f273d4e2668851f"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/contao/contao/security/advisories/GHSA-qqfq-7cpp-hcqj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.