CVE-2024-45612
MEDIUM5.3EPSS 0.55%Contao affected by insert tag injection via canonical URL
發布日:2024/9/17修改日:2024/9/23
描述
### Impact It is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered. ### Patches Update to Contao 4.13.49, 5.3.15 or 5.4.3. ### Workarounds Disable canonical tags in the settings of the website root page. ### References https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
受影響套件(1)
- Packagist/contao/core-bundle>= 4.13.0, < 4.13.49
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
參考連結(7)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-45612
- PATCHhttps://github.com/contao/contao
- WEBhttps://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
- WEBhttps://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2
- WEBhttps://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66
- WEBhttps://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590
- WEBhttps://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj