UpHeron
All vulnerabilities

Servers and applications

CVE-2019-19712

Information disclosure in the back end

Severity
Medium 5.3
Published
17 Dec 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.4.46
Exploit chance
0.9% in the next 30 daysHigher than 59% of CVEs. EPSS by FIRST, 10 Nov 2026
Also known as
GHSA-4mvc-qc5w-v5qr
Sources
NVD, Project advisories (GitHub)

Description

Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

From contao/contao's security advisory.

Workarounds

None.

Workarounds as given by contao/contao's security advisory.

Affected software

SoftwareAffected versions
ContaoServers and applications · cpe:a:contao:contao
  • From 4.8 up to 4.8.5
  • Version 4.7
  • Version 4.6
  • Version 4.5
All 9 release lines
  • Version 4.0
  • Version 4.1
  • Version 4.2
  • Version 4.3
  • From 4.4.0 up to 4.4.45
  • Version 4.5
  • Version 4.6
  • Version 4.7
  • From 4.8 up to 4.8.5
ContaoServers and applications · github:contao/contao
  • From 4.0.0 before 4.4.46

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-19712
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-19712
  • GitHub Advisory Database https://github.com/advisories/GHSA-4mvc-qc5w-v5qr
  • github.com https://github.com/contao/contao/security/advisories/GHSA-4mvc-qc5w-v5qr