CVE-2018-14716

A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements…

published August 6, 2018

CVSS
—
EPSS
33%
Percentile
98.3
In the wild
Unconfirmed
What it is

A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.32673 · 98.3th percentile
Published
2018-08-06T20:00Z
EPSS history
Timeline
  • 06 AUG 20:00Z
    A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements…
    cvelistv5