CVE-2020-9757
First published: Wed Mar 04 2020(Updated: )
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Craftcms Craft Cms | <3.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt
- https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md
- https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b
- https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f
Frequently Asked Questions
What is CVE-2020-9757?
CVE-2020-9757 is a vulnerability in the Seomatic component before version 3.2.46 for Craft CMS that allows Server-Side Template Injection and information disclosure.
How severe is CVE-2020-9757?
CVE-2020-9757 has a severity rating of 9.8 out of 10, which is considered critical.
How does CVE-2020-9757 work?
CVE-2020-9757 allows an attacker to inject malicious code into server-side templates and can lead to unauthorized access and information disclosure.
Is there a fix for CVE-2020-9757?
Yes, updating to version 3.3.0 or later of the Seomatic component for Craft CMS remedies the CVE-2020-9757 vulnerability.
Where can I find more information about CVE-2020-9757?
You can find more information about CVE-2020-9757 at the official NIST vulnerability database and the GitHub commits for the Craft CMS Seomatic component.
- collector/nvd-cve
- collector/nvd-index
- collector/github-advisory
- alias/GHSA-6q4j-8pjm-5mgc
- alias/CVE-2020-9757
- collector/github-advisory-latest
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- vendor/craftcms
- canonical/craftcms craft cms
- package-manager/composer