PT-2022-16968 · Contao · Contao

Leofeyer · Published 2022-05-05 · Updated 2022-05-20 · CVE-2022-24899

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contao versions prior to 4.13.3

Description The issue allows untrusted users to inject malicious code into the canonical tag, which is then executed on the web page. This can be done in versions of Contao prior to 4.13.3. As a temporary measure, users may disable canonical tags in the root page settings to mitigate the risk.

Recommendations Update to Contao 4.13.3. As a temporary workaround, consider disabling canonical tags in the root page settings until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24899

GHSA-M8X6-6R63-QVJ2

Affected Products

Contao

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24899.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2022-24899.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2022-24899.yaml · Exploit
• https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c · Patch
• https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24899 · Security Note
• https://osv.dev/vulnerability/GHSA-m8x6-6r63-qvj2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24899 · Vendor Advisory
• https://github.com/contao/contao · Note
• https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2 · Note
• https://t.me/cvenotify/29782 · Telegram Post
• https://t.me/cibsecurity/42084 · Telegram Post