PT-2020-13270
CVE-2020-12790
·
Published
2020-05-11
·
Updated
2022-05-24
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
SEOmatic plugin versions prior to 3.2.49 for Craft CMS
Description
The issue arises from improper sanitization of the URL in the helpers/DynamicMeta.php file, leading to Server-Side Template Injection. This can result in credentials disclosure via a crafted Twig template after a semicolon.
Recommendations
For versions prior to 3.2.49, update to version 3.2.49 or later to resolve the issue.
Found an issue in the description? Have something to add? Feel free to write us 👾