CVE-2022-24899

Katalog CVE

CVSS 6.1 · Medium EPSS 4,5%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada contao. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.

Rincian

Terbit di NVD

6 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

4,5% peluang dieksploitasi; lebih tinggi dari 91,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html advisory vendor
• https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c patch · advisory pihak ketiga
• https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2 advisory pihak ketiga