GHSA-m8x6-6r63-qvj2

Suggest an improvement
Source
https://github.com/advisories/GHSA-m8x6-6r63-qvj2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-m8x6-6r63-qvj2/GHSA-m8x6-6r63-qvj2.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-m8x6-6r63-qvj2
Aliases
Published
2022-05-20T19:54:56Z
Modified
2024-04-22T18:45:57.275746Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cross site scripting via canonical tag in Contao
Details

Impact

Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end).

Patches

Update to Contao 4.13.3.

Workarounds

Disable canonical tags in the root page settings.

References

https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

Database specific
{
    "nvd_published_at": "2022-05-06T00:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-20T19:54:56Z"
}
References

Affected packages

Packagist / contao/core-bundle

Package

Name
contao/core-bundle
Purl
pkg:composer/contao/core-bundle

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.13.0
Fixed
4.13.3

Affected versions

4.*

4.13.0
4.13.1
4.13.2

Packagist / contao/contao

Package

Name
contao/contao
Purl
pkg:composer/contao/contao

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.13.0
Fixed
4.13.3

Affected versions

4.*

4.13.0
4.13.1
4.13.2