CRITICAL9.8

GHSA-6q4j-8pjm-5mgc

SEOmatic for CraftCMS allows Server-Side Template Injection

Quick fix

GHSA-6q4j-8pjm-5mgc — nystudio107/craft-seomatic: upgrade to the fixed version with the command below.

composer require nystudio107/craft-seomatic:^3.3.0

Details

The Seomatic component before 3.2.46 for Craft CMS allows Server-Side Template Injection and information disclosure via malformed data to the metacontainers controller.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/nystudio107/craft-seomatic

Introduced in: 0Fixed in: 3.3.0

Fixcomposer require nystudio107/craft-seomatic:^3.3.0

References

https://nvd.nist.gov/vuln/detail/CVE-2020-9757[ADVISORY]
https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b[WEB]
https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f[WEB]
https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt[WEB]
https://github.com/nystudio107/craft-seomatic[PACKAGE]
https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md[WEB]