Contao affected by insert tag injection via canonical URL
### Impact It is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered. ### Patches Update to Contao 4.13.49, 5.3.15 or 5.4.3. ### Workarounds Disable canonical tags in the settings of the website root page. ### References https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-45612US | medium5.3 | — | ||
Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are a… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urlsWEB
- https://github.com/contao/contaoPACKAGE
- https://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2WEB
- https://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66WEB
- https://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590WEB
- https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgjWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-45612ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan