GHSA-M8X6-6R63-QVJ2 Cross site scripting via canonical tag in Contao

🗓️ 20 May 2022 19:54:56Reported by GoogleType

osv🔗 osv.dev👁 37 Views

Cross site scripting via canonical tag in Contao. Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end). Update to Contao 4.13.3 to patch

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2022-24899	6 May 202207:22	–	circl
CNNVD	Contao 跨站脚本漏洞	5 May 202200:00	–	cnnvd
Contao	Cross site scripting via canonical URL	5 May 202200:00	–	contao
CVE	CVE-2022-24899	5 May 202223:45	–	cve
Cvelist	CVE-2022-24899 Cross site scripting via canonical tag	5 May 202223:45	–	cvelist
Huntr	Cross-site Scripting (XSS)	28 Apr 202210:33	–	huntr
Friends Of PHP	Cross site scripting via canonical URL	5 May 202206:38	–	friendsofphp
Friends Of PHP	Cross site scripting via canonical URL	5 May 202206:38	–	friendsofphp
Github Security Blog	Cross site scripting via canonical tag in Contao	20 May 202219:54	–	github
Nuclei	Contao <4.13.3 - Cross-Site Scripting	20 Jul 202605:01	–	nuclei

Source	Link
github	www.github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-24899
github	www.github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c
contao	www.contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2022-24899.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2022-24899.yaml
github	www.github.com/contao/contao

17 Apr 2025 13:20Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.17.2

EPSS0.04396