CVE-2024-28235
Contao possible cookie sharing with external domains while checking protected pages for broken links
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Contao possible cookie sharing with external domains while checking protected pages for broken links
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
- Record
CVE-2024-28235- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2024-1172
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
- Record
EUVD-2024-1172- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9jh5-qf84-x6pr
Contao: Possible cookie sharing with external domains while checking protected pages for broken links
Impact
If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs.
Patches
Update to Contao 4.13.40 or 5.3.4.
Workarounds
Disable crawling protected pages.
References
https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
- Record
GHSA-9jh5-qf84-x6pr- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
- Record
CVE-2024-28235- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Contao possible cookie sharing with external domains while checking protected pages for broken links
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
- Record
CVE-2024-28235- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-9jh5-qf84-x6pr
Contao: Possible cookie sharing with external domains while checking protected pages for broken links
Impact
If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs.
Patches
Update to Contao 4.13.40 or 5.3.4.
Workarounds
Disable crawling protected pages.
References
https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
- Record
GHSA-9jh5-qf84-x6pr- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
contao/core-bundlePackagist |
4.9.0 up to 4.13.40 | 4.13.40 |
contao/core-bundlePackagist |
5.0.0-RC1 up to 5.3.4 | 5.3.4 |
contao/core-bundlePackagist |
4.9.0 up to 4.13.40, plus listed versions 4.10.04.10.0-RC14.10.0-RC24.10.0-RC34.10.0-RC4 Show 45 moreShow less4.10.14.10.24.10.34.10.44.10.54.10.64.10.74.11.04.11.0-RC14.11.0-RC24.11.14.11.24.11.34.11.44.11.54.11.64.11.74.11.84.11.94.12.04.12.0-RC14.12.0-RC24.12.0-RC34.12.14.12.24.12.34.12.44.12.54.12.64.12.74.13.04.13.0-RC14.13.0-RC24.13.0-RC34.13.14.13.104.13.114.13.124.13.134.13.144.13.154.13.164.13.174.13.184.13.19 |
4.13.40 |
contao/core-bundlePackagist |
5.0.0-RC1 up to 5.3.4, plus listed versions 5.0.05.0.0-RC25.0.0-RC35.0.0-RC45.0.1 Show 45 moreShow less5.0.105.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.95.1.05.1.0-RC15.1.0-RC25.1.0-RC35.1.15.1.105.1.115.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-RC15.2.0-RC25.2.0-RC35.2.0-RC45.2.0-RC55.2.0-RC65.2.15.2.105.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.95.3.05.3.0-RC15.3.0-RC25.3.0-RC3 |
5.3.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-28235 is a high vulnerability (CVSS 8.4) in Contao, published April 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in contao/core-bundle 4.13.40.
References
github.com/contao/contao/security/advisories/GHSA-9jh5-qf84-x6pr
contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler
nvd.nist.gov/vuln/detail/CVE-2024-28235
Left out here: 74 versions. The JSON record has them.