CVE-2022-24899

Cross site scripting via canonical tag

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.

Affected

contao

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1 GITHUB

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

4.48% chance of exploitation in the next 30 days, 91st percentile

Nuclei

medium · CWE-79

Published

2022-05-05

Updated

2025-04-23

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24899.yaml

Security advisories

• https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
• contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c
• contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2
• advisories/GHSA-m8x6-6r63-qvj2

References

• CVE Record
• NVD entry