Contao affected by insert tag injection via canonical URL
### Impact It is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered. ### Patches Update to Contao 4.13.49, 5.3.15 or 5.4.3. ### Workarounds Disable canonical tags in the settings of the website root page. ### References https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-45612US | medium5.3 | — | ||
Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are a… | ||||
references
External citations — patches, advisories, analysis.
- https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urlsWEB
- https://github.com/contao/contaoPACKAGE
- https://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2WEB
- https://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66WEB
- https://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590WEB
- https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgjWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-45612ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan