GitHub Advisoryadvisory · Packagist

GHSA-2xpq-xp6c-5mgj Contao affected by insert tag injection via canonical URL

MEDIUM Published 2024-09-17 Modified 2024-09-23 Official page ↗
Aliases
CVE-2024-45612
Ecosystem
Packagist
Packages
contao/core-bundle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-20, CWE-74, CWE-79
Reviewed
2024-09-17

Affected packages

• Packagist contao/core-bundle: >= 4.13.0, < 4.13.49 → fixed in 4.13.49 • Packagist contao/core-bundle: >= 5.0.0, < 5.3.15 → fixed in 5.3.15 • Packagist contao/core-bundle: >= 5.4.0, < 5.4.3 → fixed in 5.4.3

Description

Impact It is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered. Patches Update to Contao 4.13.49, 5.3.15 or 5.4.3. Workarounds Disable canonical tags in the settings of the website root page. References https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls For more information If you have any questions or comments about this advisory, open an issue in contao/contao.

Related

Alias · CVE (1)

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References