GitHub Advisoryadvisory · Packagist
GHSA-m8x6-6r63-qvj2 Cross site scripting via canonical tag in Contao
HIGH
Official page ↗
- Aliases
- CVE-2022-24899
- Ecosystem
- Packagist
- Packages
- contao/core-bundle, contao/contao
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2022-05-20
Affected packages
• Packagist contao/core-bundle: >= 4.13.0, < 4.13.3 → fixed in 4.13.3
• Packagist contao/contao: >= 4.13.0, < 4.13.3 → fixed in 4.13.3
Description
Impact
Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end).
Patches
Update to Contao 4.13.3.
Workarounds
Disable canonical tags in the root page settings.
References
https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Related
Alias · CVE (1)
- CVE-2022-24899 Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2 web
- https://nvd.nist.gov/vuln/detail/CVE-2022-24899 advisory
- https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c web
- https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2022-24899.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2022-24899.yaml web
- https://github.com/contao/contao package