Executive brief
Cross site scripting via canonical tag in Contao
Affected products
- Packagist contao/core-bundle
- Packagist contao/contao
Junglewise Threat Intelligence
CVE-2022-24899: Cross site scripting via canonical tag in Contao
CVE-2022-24899 · Severity: low · CVSS 3.1 · Published 2022-05-20
Technologies: contao/core-bundle (Packagist), contao/contao (Packagist). Vendors: Packagist.
Related threats
- Contao path traversal in job attachment downloads
- Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript
- Contao affected by directory traversal in the file selector widget
- Contao: Remember-me tokens will not be cleared after a password change
- Contao CSRF Token Bypass