Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2022-24899

HIGH
Published 2022-05-05T23:45:13.000Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2022-24899. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
7.2
/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.545
probability
of exploitation in the wild

There is a 54.5% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.979
Higher than 97.9% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED

Impact Metrics

Confidentiality
LOW
Integrity
LOW
Availability
NONE

Description

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.

Available Exploits

Contao <4.13.3 - Cross-Site Scripting

Contao prior to 4.13.3 contains a cross-site scripting vulnerability. It is possible to inject arbitrary JavaScript code into the canonical tag.

ID: CVE-2022-24899
Author: ritikchaddha Medium

References:

Related News

No news articles found for this CVE.

Affected Products

contao

contao

Affected Versions:

< 4.13.3

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

Cross site scripting via canonical tag in Contao

GHSA-m8x6-6r63-qvj2

Advisory Details

### Impact Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end). ### Patches Update to Contao 4.13.3. ### Workarounds Disable canonical tags in the root page settings. ### References https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

Affected Packages

Packagist contao/core-bundle
ECOSYSTEM: ≥4.13.0 <4.13.3
Packagist contao/contao
ECOSYSTEM: ≥4.13.0 <4.13.3

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

WEB https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-24899
WEB https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c
WEB https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
WEB https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2022-24899.yaml
WEB https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2022-24899.yaml
PACKAGE https://github.com/contao/contao

Advisory provided by GitHub Security Advisory Database. Published: May 20, 2022, Modified: April 17, 2025

References

https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c
https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2
https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
Published: 2022-05-05T23:45:13.000Z
Last Modified: 2025-04-23T18:29:58.265Z
Copied to clipboard!