CVE-2018-5478: XSS vulnerability in the newsletter extension

January 18, 2018

The vulnerability is in the “unsubscribe” module of the newsletter extension and can easily be exploited by anyone in the front end. If you are not using the newsletter extension or the “unsubscribe” module, your installation is not affected by the vulnerability.

References

contao.org/en/news/contao-3_5_32.html

Code Behaviors & Features

Detect and mitigate CVE-2018-5478 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →