GitHub Advisoryadvisory · Packagist
GHSA-6j9m-rp7m-3gfg SEOmatic plugin for Craft CMS SSTI Vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2018-14716
- Ecosystem
- Packagist
- Packages
- nystudio107/craft-seomatic
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-94
- Reviewed
- 2023-07-21
Affected packages
• Packagist nystudio107/craft-seomatic: < 3.1.4 → fixed in 3.1.4
Description
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
Related
Alias · CVE (1)
- CVE-2018-14716 A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match… vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-14716 advisory
- https://github.com/nystudio107/craft-seomatic/commit/1e7d1d084ac3a89e7ec70620f2749110508d1ce1 web
- https://github.com/nystudio107/craft-seomatic package
- https://github.com/nystudio107/craft-seomatic/releases/tag/3.1.4 web
- https://twitter.com/nystudio107/status/1021847835418009605 web
- https://twitter.com/nystudio107/status/1021855169515057152 web
- https://www.exploit-db.com/exploits/45108 web
- http://ha.cker.info/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomatic web