GHSA-9jh5-qf84-x6pr

GitHub Security Advisory

Contao: Possible cookie sharing with external domains while checking protected pages for broken links

✓ GitHub Reviewed HIGH Has CVE

### Impact

If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs.

### Patches

Update to Contao 4.13.40 or 5.3.4.

### Workarounds

Disable crawling protected pages.

### References

https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

Packagist contao/core-bundle

Affected versions: 4.9.0 (fixed in 4.13.40)

Packagist contao/core-bundle

Affected versions: 5.0.0-RC1 (fixed in 5.3.4)

CVE-2024-28235

GHSA ID

GHSA-9jh5-qf84-x6pr

Published

April 9, 2024 3:50 PM

Last Modified

April 9, 2024 9:00 PM

CVSS Score

7.5 /10

Primary Ecosystem

Packagist

Primary Package

contao/core-bundle

GitHub Reviewed

✓ Yes

Last updated: July 28, 2025 6:37 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.