GHSA-23q7-59jj-2pj4

Suggest an improvement
Source
https://github.com/advisories/GHSA-23q7-59jj-2pj4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-23q7-59jj-2pj4/GHSA-23q7-59jj-2pj4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-23q7-59jj-2pj4
Aliases
Published
2022-05-24T17:17:37Z
Modified
2024-02-16T08:24:58.209878Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
SEOmatic for CraftCMS allows Server-Side Template Injection
Details

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon.

Database specific 
{
    "nvd_published_at": "2020-05-11T19:15:00Z",
    "severity": "HIGH",
    "github_reviewed_at": "2023-07-13T00:18:26Z",
    "cwe_ids": [
        "CWE-74"
    ],
    "github_reviewed": true
}
References

Affected packages

Packagist / nystudio107/craft-seomatic

Package

Name
nystudio107/craft-seomatic
Purl
pkg:composer/nystudio107/craft-seomatic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.49

Affected versions

3.*
3.0.0-beta.1
3.0.0-beta.2
3.0.0-beta.3
3.0.0-beta.4
3.0.0-beta.5
3.0.0-beta.6
3.0.0-beta.7
3.0.0-beta.8
3.0.0-beta.9
3.0.0-beta.10
3.0.0-beta.11
3.0.0-beta.12
3.0.0-beta.13
3.0.0-beta.14
3.0.0-beta.15
3.0.0-beta.16
3.0.0-beta.17
3.0.0-beta.18
3.0.0-beta.19
3.0.0-beta.20
3.0.0-beta.21
3.0.0-beta.22
3.0.0-beta.23
3.0.0-beta.24
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.0.20
3.0.22
3.0.23
3.0.24
3.0.25
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.13.1
3.1.14
3.1.16
3.1.17
3.1.18
3.1.18.1
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.28
3.1.29
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.50
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.16
3.2.17
3.2.18
3.2.19
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.28
3.2.29
3.2.30
3.2.31
3.2.32
3.2.33
3.2.34
3.2.35
3.2.36
3.2.37
3.2.38
3.2.39
3.2.41
3.2.42
3.2.43
3.2.44
3.2.45
3.2.46
3.2.47
3.2.48

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-23q7-59jj-2pj4/GHSA-23q7-59jj-2pj4.json"