CVE-2022-24899

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-24899
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24899.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24899
Aliases
Published
2022-05-05T23:45:13Z
Modified
2025-12-04T10:19:51.597328Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cross site scripting via canonical tag
Details

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24899.json"
}
References

Affected packages

Git / github.com/contao/contao

Affected ranges

Type
GIT
Repo
https://github.com/contao/contao
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b70984c22b21cd246fc76e9098ea1b2041cf7187

Affected versions

4.*

4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.2
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.5.13
4.5.14
4.6.0
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9