CVE-2021-41750 — Cross-site Scripting in Craft-seomatic

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.5%
top 35.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nystudio107 Craft-seomaticNystudio107 Seomatic
Timeline
PublishedJun 12
Latest updateJun 13

Description

A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶Packagistnystudio107/craft-seomatic< 3.4.11

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
Cross-site Scripting in SEOmatic plugin↗2022-06-13
▶
OSV
Cross-site Scripting in SEOmatic plugin↗2022-06-13
▶