SEOmatic plugin for Craft CMS SSTI Vulnerability
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-14716US | high7.5 | Exploit | ||
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the ca… | ||||
02
references
External citations — patches, advisories, analysis.
- http://ha.cker.info/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomaticWEB
- https://github.com/nystudio107/craft-seomaticPACKAGE
- https://github.com/nystudio107/craft-seomatic/commit/1e7d1d084ac3a89e7ec70620f2749110508d1ce1WEB
- https://github.com/nystudio107/craft-seomatic/releases/tag/3.1.4WEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-14716ADVISORY
- https://twitter.com/nystudio107/status/1021847835418009605WEB
- https://twitter.com/nystudio107/status/1021855169515057152WEB
- https://www.exploit-db.com/exploits/45108WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan