CVE-2021-35210: 
PHP vulnerability analysis and mitigation

Contao versions 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5 were affected by a Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-35210. The vulnerability was discovered and disclosed on June 23, 2021. The issue affects the system log functionality in the Contao Content Management System (Vendor Advisory, GitHub Advisory).

The vulnerability allows attackers to inject malicious code into the tl_log table that gets executed when the system log is accessed in the back end. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Notably, the attack can be performed without requiring authentication (NVD).

When exploited, this vulnerability could lead to the execution of arbitrary code in the browser when an administrator or user accesses the system log in the back end. This could potentially compromise the confidentiality and integrity of the system, allowing attackers to steal sensitive information or perform actions on behalf of the affected user (GitHub Advisory).

The vulnerability is particularly concerning as it does not require authentication to exploit, though it does require user interaction (accessing the system log) to trigger the malicious code execution. The attack vector is network-accessible, with low attack complexity (NVD).

The primary mitigation is to update to Contao version 4.9.16 or 4.11.5, which contain patches for this vulnerability. For users unable to update immediately, a workaround is available: disable the system log module in the back end for all users, especially administrator users (Vendor Advisory).