What is GHSA-m3xv-x3ph-mq22?

GHSA-m3xv-x3ph-mq22 is a security advisory published by GitHub Security Advisories with High severity. Server-side Template Injection in nystudio107/craft-seomatic

Which CVE IDs does GHSA-m3xv-x3ph-mq22 cover?

GHSA-m3xv-x3ph-mq22 covers the following CVE IDs: CVE-2021-44618. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m3xv-x3ph-mq22?

GHSA-m3xv-x3ph-mq22 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-m3xv-x3ph-mq22?

GHSA-m3xv-x3ph-mq22 affects 1 product, including: composer/nystudio107/craft-seomatic:\u003c 3.4.12.

GHSA-m3xv-x3ph-mq22HighCVSS 9.8

Server-side Template Injection in nystudio107/craft-seomatic

Vendor

GitHub Security Advisories

Published

March 12, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-44618 →

📋 Description

A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic prior to 3.4.12 in src/helpers/UrlHelper.php via the host header.

🎯 Affected products1

composer/nystudio107/craft-seomatic:< 3.4.12

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-44618
https://github.com/nystudio107/craft-seomatic/commit/0c5c0c0e0cb61000d12ec55ebf174745a5bf6469
https://github.com/nystudio107/craft-seomatic/releases/tag/3.4.12
https://github.com/advisories/GHSA-m3xv-x3ph-mq22