SEOmatic plugin for Craft CMS SSTI Vulnerability
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-14716US | high7.5 | Exploit | ||
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the ca… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://ha.cker.info/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomaticWEB
- https://github.com/nystudio107/craft-seomaticPACKAGE
- https://github.com/nystudio107/craft-seomatic/commit/1e7d1d084ac3a89e7ec70620f2749110508d1ce1WEB
- https://github.com/nystudio107/craft-seomatic/releases/tag/3.1.4WEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-14716ADVISORY
- https://twitter.com/nystudio107/status/1021847835418009605WEB
- https://twitter.com/nystudio107/status/1021855169515057152WEB
- https://www.exploit-db.com/exploits/45108WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan