Vulnerability Details : CVE-2022-24899
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2022-24899
- cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-24899
0.34%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 68 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-24899
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST | |
|
7.2
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
3.9
|
2.7
|
GitHub, Inc. |
CWE ids for CVE-2022-24899
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
References for CVE-2022-24899
-
https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2
Cross site scripting via canonical URL · Advisory · contao/contao · GitHubThird Party Advisory
-
https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c
Merge pull request from GHSA-m8x6-6r63-qvj2 · contao/contao@1992068 · GitHubPatch;Third Party Advisory
-
https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
Cross site scripting via canonical URL - ContaoVendor Advisory
Jump to