CVE-2022-24899highCWE-79

CVE-2022-24899: falha de alta gravidade em contao

Cross site scripting via canonical tag

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar contao+ Monitorar contao/core-bundle

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 7.2epss 4.5%
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
contao · contao
CVEs relacionadas — contao

No mesmo produto, das mais perigosas para as menos.

CVE-2021-37626HIGHPHP file inclusion via insert tagsEPSS 1.3%CVE-2021-37627HIGHPrivilege escalation via form generatorEPSS 1.0%CVE-2012-4383—CVE-2012-4383EPSS 0.9%CVE-2023-29200MEDIUMcontao/core-bundle has path traversal vulnerability in the file managerEPSS 0.8%CVE-2024-28235HIGHContao possible cookie sharing with external domains while checking protected pages for broken linksEPSS 0.7%CVE-2023-36806MEDIUMContao cross site scripting vulnerability via input unit widgetEPSS 0.6%