CVE-2020-9757

Katalog CVE

CVSS 9.8 · Critical EPSS 72,8%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada craftcms craft cms. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.

Rincian

Terbit di NVD

4 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

72,8% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b patch · advisory pihak ketiga
• https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f patch · advisory pihak ketiga
• https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt exploit · advisory pihak ketiga
• https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md release notes · advisory pihak ketiga