CVE-2022-24899highCWE-79

CVE-2022-24899: fallo de gravedad alta en contao

Cross site scripting via canonical tag

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear contao+ Monitorear contao/core-bundle

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 7.2epss 4.5%
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Productos afectados
contao · contao
CVEs relacionadas — contao

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-37626HIGHPHP file inclusion via insert tagsEPSS 1.3%CVE-2021-37627HIGHPrivilege escalation via form generatorEPSS 1.0%CVE-2012-4383—CVE-2012-4383EPSS 0.9%CVE-2023-29200MEDIUMcontao/core-bundle has path traversal vulnerability in the file managerEPSS 0.8%CVE-2024-28235HIGHContao possible cookie sharing with external domains while checking protected pages for broken linksEPSS 0.7%CVE-2023-36806MEDIUMContao cross site scripting vulnerability via input unit widgetEPSS 0.6%