GHSA-6q4j-8pjm-5mgc

SEOmatic for CraftCMS allows Server-Side Template Injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-9757

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	nystudio107/craft-seomatic	< 3.3.0	3.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

The Seomatic component before 3.2.46 for Craft CMS allows Server-Side Template Injection and information disclosure via malformed data to the metacontainers controller.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-9757 advisory
https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b web
https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f web
https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt web
https://github.com/nystudio107/craft-seomatic package
https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md web