GHSA-m3xv-x3ph-mq22

ghsaUSosv

Server-side Template Injection in nystudio107/craft-seomatic

view advisory published 2022-03-12Licence: CC-BY-4.0

A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic prior to 3.4.12 in src/helpers/UrlHelper.php via the host header.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-44618US	critical9.8	1.40% (72nd)	—	2022-03-11
A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header.

references

External citations — patches, advisories, analysis.

https://github.com/nystudio107/craft-seomaticPACKAGE
https://github.com/nystudio107/craft-seomatic/commit/0c5c0c0e0cb61000d12ec55ebf174745a5bf6469WEB
https://github.com/nystudio107/craft-seomatic/releases/tag/3.4.12WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-44618ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan