CVE-2021-41750

State: Published
Severity: Not scored
Published: Jun 12, 2022
Updated: Aug 4, 2024
Reserved: Sep 27, 2021

Description

A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md
https://github.com/nystudio107/craft-seomatic/commit/5f2cdc7c39e0a4bfb60d2f84131508f0a87b2873
https://github.com/nystudio107/craft-seomatic/commit/4e46b792ce973ac0c652fb330055f41aca1981c8

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.