Vulnerability DatabaseCVE-2024-45612
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2024-45612
Published At:September 17, 2024
Updated At:April 07, 2026
Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.
Related Resources (7)
https://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590
https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj
https://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66
https://nvd.nist.gov/vuln/detail/CVE-2024-45612
https://github.com/contao/contao
https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
https://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.9
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Improper Input Validation
CWE-20
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74
EPSS
Base Score:
0.55