⌘ + K

GHSA-6q4j-8pjm-5mgc

Dashboard / Vulnerabilities / GHSA-6q4j-8pjm-5mgc

GHSA-6q4j-8pjm-5mgc

Published: 24 May 2022Last Modified: 16 Feb 2024

Aliases:

CVE-2020-9757

Summary: SEOmatic for CraftCMS allows Server-Side Template Injection

Details: The Seomatic component before 3.2.46 for Craft CMS allows Server-Side Template Injection and information disclosure via malformed data to the metacontainers controller.

References: https://nvd.nist.gov/vuln/detail/CVE-2020-9757, https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b, https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f, https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt, https://github.com/nystudio107/craft-seomatic, https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md

Affected packages

Package

Name: nystudio107/craft-seomatic

Purl: pkg:composer/nystudio107/craft-seomatic

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -3.3.0

Affected versions

3.0.0

3.0.0-beta.1

3.0.0-beta.10

3.0.0-beta.11

3.0.0-beta.12

3.0.0-beta.13

3.0.0-beta.14

3.0.0-beta.15

3.0.0-beta.16

3.0.0-beta.17

3.0.0-beta.18

3.0.0-beta.19

3.0.0-beta.2

3.0.0-beta.20

3.0.0-beta.21

3.0.0-beta.22

3.0.0-beta.23

3.0.0-beta.24

3.0.0-beta.3

3.0.0-beta.4

3.0.0-beta.5

3.0.0-beta.6

3.0.0-beta.7

3.0.0-beta.8

3.0.0-beta.9

3.0.1

3.0.10

3.0.11

3.0.12

3.0.13

3.0.14

3.0.15

3.0.16

3.0.17

3.0.18

3.0.2

3.0.20

3.0.22

3.0.23

3.0.24

3.0.25

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High