CVE-2021-41750: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

June 12, 2022 (updated June 17, 2022)

A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user’s browser as the extension.

References

github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md
github.com/nystudio107/craft-seomatic/commit/4e46b792ce973ac0c652fb330055f41aca1981c8
github.com/nystudio107/craft-seomatic/commit/5f2cdc7c39e0a4bfb60d2f84131508f0a87b2873
nvd.nist.gov/vuln/detail/CVE-2021-41750

Code Behaviors & Features

Detect and mitigate CVE-2021-41750 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →