CVE-2020-9757
critical · 9.8A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
9.8
CVSS
72.8%
EPSS (exploit prob.)
99th
EPSS percentile
2020-03-04
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| craftcms | craft_cms | < 3.3.0 |
Check a specific version with /api/v1/cve/match.
References
- https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt
- https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md
- https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b
- https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f
- https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt
- https://github.com/nystudio107/craft-seomatic/blob/v3/CHANGELOG.md
- https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b
- https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-9757