CVE-2020-9757 - The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller

Back Back to CVE browser

CRITICAL

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller

Published Mar 4, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 72.82%

Description

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-74

References (6)

https://github.com/advisories/GHSA-6q4j-8pjm-5mgc
Advisory
https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt
x_refsource_MISCExploitThird Party Advisory
https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md
x_refsource_MISCRelease NotesThird Party Advisory
https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b
x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f
x_refsource_CONFIRMPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9757

Link	Providers	Tags
https://github.com/advisories/GHSA-6q4j-8pjm-5mgc		Advisory
https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt		x_refsource_MISCExploitThird Party Advisory
https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md		x_refsource_MISCRelease NotesThird Party Advisory
https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b		x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f		x_refsource_CONFIRMPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9757

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Mar 4, 2020

Updated Aug 4, 2024

Reserved Mar 2, 2020

Link CVE-2020-9757

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-9757

Red Hat

Severity n/a

Public date n/a

Links CVE-2020-9757

GHSA-6Q4J-8PJM-5MGC