CVE-2018-14716 SEOmatic plugin for Craft CMS SSTI Vulnerability
HighCVSS 7.5
EPSS 32.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nystudio107/craft-seomatic(Packagist) | < 3.1.4 | 3.1.4 |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.1 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.10 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.11 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.12 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.13 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.14 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.15 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.16 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.17 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.18 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.19 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.2 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.20 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.21 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.22 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.23 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.24 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.3 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.4 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.5 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.6 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.7 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.8 | No fix listed |
Show 29 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nystudio107/craft-seomatic(Packagist) | = 3.0.0-beta.9 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.1 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.10 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.11 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.12 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.13 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.14 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.15 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.16 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.17 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.18 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.2 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.20 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.22 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.23 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.24 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.25 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.3 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.4 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.5 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.6 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.7 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.8 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.0.9 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.1.0 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.1.1 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.1.2 | No fix listed |
| nystudio107/craft-seomatic(Packagist) | = 3.1.3 | No fix listed |
| nystudio107 seomatic | < 3.1.4 | 3.1.4 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch vendor-advisory
- github.com product
- github.com patch vendor-advisory
- twitter.com vendor-advisory
- twitter.com vendor-advisory
- 45108 exploit third-party-advisory vdb-entry
- ha.cker.info third-party-advisory
- github.com