Cross-site Scripting in SEOmatic plugin
The advisory, in context
A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 3.4.11
Fixed in 3.4.11
210 explicitly affected versions
3.0.0, 3.0.0-beta.1, 3.0.0-beta.10, 3.0.0-beta.11, 3.0.0-beta.12, 3.0.0-beta.13, 3.0.0-beta.14, 3.0.0-beta.15, 3.0.0-beta.16, 3.0.0-beta.17, 3.0.0-beta.18, 3.0.0-beta.19, 3.0.0-beta.2, 3.0.0-beta.20, 3.0.0-beta.21, 3.0.0-beta.22, 3.0.0-beta.23, 3.0.0-beta.24, 3.0.0-beta.3, 3.0.0-beta.4, 3.0.0-beta.5, 3.0.0-beta.6, 3.0.0-beta.7, 3.0.0-beta.8, 3.0.0-beta.9, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 3.0.2, 3.0.20, 3.0.22, 3.0.23, 3.0.24, 3.0.25, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.13, 3.1.13.1, 3.1.14, 3.1.16, 3.1.17, 3.1.18, 3.1.18.1, 3.1.19, 3.1.2, 3.1.20, 3.1.21, 3.1.22, 3.1.23, 3.1.24, 3.1.25, 3.1.26, 3.1.27, 3.1.28, 3.1.29, 3.1.3, 3.1.30, 3.1.31, 3.1.32, 3.1.33, 3.1.34, 3.1.35, 3.1.36, 3.1.37, 3.1.38, 3.1.39, 3.1.4, 3.1.40, 3.1.41, 3.1.42, 3.1.43, 3.1.44, 3.1.45, 3.1.46, 3.1.47, 3.1.48, 3.1.49, 3.1.5, 3.1.50, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.2.0, 3.2.1, 3.2.10, 3.2.11, 3.2.12, 3.2.13, 3.2.14, 3.2.16, 3.2.17, 3.2.18, 3.2.19, 3.2.2, 3.2.20, 3.2.21, 3.2.22, 3.2.23, 3.2.24, 3.2.25, 3.2.26, 3.2.27, 3.2.28, 3.2.29, 3.2.3, 3.2.30, 3.2.31, 3.2.32, 3.2.33, 3.2.34, 3.2.35, 3.2.36, 3.2.37, 3.2.38, 3.2.39, 3.2.4, 3.2.41, 3.2.42, 3.2.43, 3.2.44, 3.2.45, 3.2.46, 3.2.47, 3.2.48, 3.2.49, 3.2.5, 3.2.50, 3.2.51, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.3.0, 3.3.1, 3.3.10, 3.3.11, 3.3.12, 3.3.13, 3.3.14, 3.3.15, 3.3.16, 3.3.17, 3.3.18, 3.3.19, 3.3.2, 3.3.20, 3.3.21, 3.3.22, 3.3.23, 3.3.24, 3.3.25, 3.3.26, 3.3.27, 3.3.28, 3.3.29, 3.3.3, 3.3.30, 3.3.31, 3.3.32, 3.3.33, 3.3.34, 3.3.35, 3.3.36, 3.3.37, 3.3.38, 3.3.39, 3.3.4, 3.3.40, 3.3.41, 3.3.42, 3.3.43, 3.3.44, 3.3.45, 3.3.46, 3.3.47, 3.3.48, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.4.0, 3.4.1, 3.4.10, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.11"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0",
"3.0.0-beta.1",
"3.0.0-beta.10",
"3.0.0-beta.11",
"3.0.0-beta.12",
"3.0.0-beta.13",
"3.0.0-beta.14",
"3.0.0-beta.15",
"3.0.0-beta.16",
"3.0.0-beta.17",
"3.0.0-beta.18",
"3.0.0-beta.19",
"3.0.0-beta.2",
"3.0.0-beta.20",
"3.0.0-beta.21",
"3.0.0-beta.22",
"3.0.0-beta.23",
"3.0.0-beta.24",
"3.0.0-beta.3",
"3.0.0-beta.4",
"3.0.0-beta.5",
"3.0.0-beta.6",
"3.0.0-beta.7",
"3.0.0-beta.8",
"3.0.0-beta.9",
"3.0.1",
"3.0.10",
"3.0.11",
"3.0.12",
"3.0.13",
"3.0.14",
"3.0.15",
"3.0.16",
"3.0.17",
"3.0.18",
"3.0.2",
"3.0.20",
"3.0.22",
"3.0.23",
"3.0.24",
"3.0.25",
"3.0.3",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"3.1.0",
"3.1.1",
"3.1.10",
"3.1.11",
"3.1.12",
"3.1.13",
"3.1.13.1",
"3.1.14",
"3.1.16",
"3.1.17",
"3.1.18",
"3.1.18.1",
"3.1.19",
"3.1.2",
"3.1.20",
"3.1.21",
"3.1.22",
"3.1.23",
"3.1.24",
"3.1.25",
"3.1.26",
"3.1.27",
"3.1.28",
"3.1.29",
"3.1.3",
"3.1.30",
"3.1.31",
"3.1.32",
"3.1.33",
"3.1.34",
"3.1.35",
"3.1.36",
"3.1.37",
"3.1.38",
"3.1.39",
"3.1.4",
"3.1.40",
"3.1.41",
"3.1.42",
"3.1.43",
"3.1.44",
"3.1.45",
"3.1.46",
"3.1.47",
"3.1.48",
"3.1.49",
"3.1.5",
"3.1.50",
"3.1.6",
"3.1.7",
"3.1.8",
"3.1.9",
"3.2.0",
"3.2.1",
"3.2.10",
"3.2.11",
"3.2.12",
"3.2.13",
"3.2.14",
"3.2.16",
"3.2.17",
"3.2.18",
"3.2.19",
"3.2.2",
"3.2.20",
"3.2.21",
"3.2.22",
"3.2.23",
"3.2.24",
"3.2.25",
"3.2.26",
"3.2.27",
"3.2.28",
"3.2.29",
"3.2.3",
"3.2.30",
"3.2.31",
"3.2.32",
"3.2.33",
"3.2.34",
"3.2.35",
"3.2.36",
"3.2.37",
"3.2.38",
"3.2.39",
"3.2.4",
"3.2.41",
"3.2.42",
"3.2.43",
"3.2.44",
"3.2.45",
"3.2.46",
"3.2.47",
"3.2.48",
"3.2.49",
"3.2.5",
"3.2.50",
"3.2.51",
"3.2.6",
"3.2.7",
"3.2.8",
"3.2.9",
"3.3.0",
"3.3.1",
"3.3.10",
"3.3.11",
"3.3.12",
"3.3.13",
"3.3.14",
"3.3.15",
"3.3.16",
"3.3.17",
"3.3.18",
"3.3.19",
"3.3.2",
"3.3.20",
"3.3.21",
"3.3.22",
"3.3.23",
"3.3.24",
"3.3.25",
"3.3.26",
"3.3.27",
"3.3.28",
"3.3.29",
"3.3.3",
"3.3.30",
"3.3.31",
"3.3.32",
"3.3.33",
"3.3.34",
"3.3.35",
"3.3.36",
"3.3.37",
"3.3.38",
"3.3.39",
"3.3.4",
"3.3.40",
"3.3.41",
"3.3.42",
"3.3.43",
"3.3.44",
"3.3.45",
"3.3.46",
"3.3.47",
"3.3.48",
"3.3.5",
"3.3.6",
"3.3.7",
"3.3.8",
"3.3.9",
"3.4.0",
"3.4.1",
"3.4.10",
"3.4.2",
"3.4.3",
"3.4.4",
"3.4.5",
"3.4.6",
"3.4.7",
"3.4.8",
"3.4.9"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2021-41750
- https://github.com/nystudio107/craft-seomatic/commit/4e46b792ce973ac0c652fb330055f41aca1981c8
- https://github.com/nystudio107/craft-seomatic/commit/5f2cdc7c39e0a4bfb60d2f84131508f0a87b2873
- https://github.com/nystudio107/craft-seomatic
- https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md