CVE-2022-24899

Cross site scripting via canonical tag

State: Published
Severity: 7.2 High
Published: May 5, 2022
Updated: Apr 23, 2025
Reserved: Feb 10, 2022

Description

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
contaocontao	< 4.13.3Affected

References

https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c
https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2
https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.