CVE-2022-24899: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 6, 2022 (updated May 13, 2022)

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.

References

contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c
github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2
nvd.nist.gov/vuln/detail/CVE-2022-24899

Detect and mitigate CVE-2022-24899 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →