CVE-2024-45612: Insert tag injection via canonical URL in Contao
Impact
It is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered.
Patches
Update to Contao 4.13.49, 5.3.15 or 5.4.3.
Workarounds
Disable canonical tags in the settings of the website root page.
References
https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Other sources
Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45612?
CVE-2024-45612 is considered a moderate severity vulnerability due to its potential for injective HTML content into canonical URLs.
How do I fix CVE-2024-45612?
To fix CVE-2024-45612, you should update your Contao installation to versions 4.13.49, 5.3.15, or 5.4.3.
What are the affected versions for CVE-2024-45612?
CVE-2024-45612 affects Contao versions 4.13.0 to 4.13.49, 5.0.0 to 5.3.15, and 5.4.0 to 5.4.3.
What is the workaround for CVE-2024-45612?
The workaround for CVE-2024-45612 is to disable canonical tags in the settings of the website root page.
What does CVE-2024-45612 allow attackers to do?
CVE-2024-45612 allows attackers to inject insert tags in canonical URLs, which could lead to compromised rendering of the web page.