{"id":"CVE-2024-45612","aliases":["EUVD-2024-2699","GHSA-2xpq-xp6c-5mgj"],"status":"published","title":"Insert tag injection via canonical URL in Contao","description":"Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00298,"percentile":0.22715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-74","CWE-79"],"published":"2024-09-17T14:59:02Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"Packagist","package":"contao/core-bundle","fixed_in":["4.13.49","5.3.15","5.4.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"contao/core-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.13.0"},{"fixed":"4.13.49"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"contao/core-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.3.15"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"contao/core-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"contao/core-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.13.0"},{"fixed":"4.13.49"}]}],"versions":["4.13.0","4.13.1","4.13.10","4.13.11","4.13.12","4.13.13","4.13.14","4.13.15","4.13.16","4.13.17","4.13.18","4.13.19","4.13.2","4.13.20","4.13.21","4.13.22","4.13.23","4.13.24","4.13.25","4.13.26","4.13.27","4.13.28","4.13.29","4.13.3","4.13.30","4.13.31","4.13.32","4.13.33","4.13.34","4.13.35","4.13.36","4.13.37","4.13.38","4.13.39","4.13.4","4.13.40","4.13.41","4.13.42","4.13.43","4.13.44","4.13.45","4.13.46","4.13.47","4.13.48","4.13.5","4.13.6","4.13.7","4.13.8","4.13.9"]},{"source":"osv","ecosystem":"Packagist","package":"contao/core-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.3.15"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.0-RC1","5.1.0-RC2","5.1.0-RC3","5.1.1","5.1.10","5.1.11","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8","5.1.9","5.2.0","5.2.0-RC1","5.2.0-RC2","5.2.0-RC3","5.2.0-RC4","5.2.0-RC5","5.2.0-RC6","5.2.1","5.2.10","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9","5.3.0","5.3.0-RC1","5.3.0-RC2","5.3.0-RC3","5.3.0-RC4","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.14","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9"]},{"source":"osv","ecosystem":"Packagist","package":"contao/core-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.3"}]}],"versions":["5.4.0","5.4.1","5.4.2"]}],"products":[{"vendor":"contao","product":"contao"}],"references":[{"url":"https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls","tags":["x_refsource_MISC","Vendor Advisory","advisory","web"]},{"url":"https://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2","tags":["web"]},{"url":"https://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66","tags":["web"]},{"url":"https://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45612","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2xpq-xp6c-5mgj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45612.json","tags":["advisory"]},{"url":"https://github.com/contao/contao","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-45612","title":"Insert tag injection via canonical URL in Contao","description":"Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.","status":"published","published":"2024-09-17T18:29:27.21Z","modified":"2024-09-18T14:09:48.584Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2024-2699","description":"Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.","status":"published","published":"2024-09-17T18:29:27Z","modified":"2024-09-18T14:09:48Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:21.470786Z"}],"ghsa":[{"id":"GHSA-2xpq-xp6c-5mgj","title":"Contao affected by insert tag injection via canonical URL","description":"### Impact\n\nIt is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered.\n\n### Patches\n\nUpdate to Contao 4.13.49, 5.3.15 or 5.4.3.\n\n### Workarounds\n\nDisable canonical tags in the settings of the website root page.\n\n### References\n\nhttps://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).","status":"published","published":"2024-09-17T14:59:02Z","modified":"2024-09-23T21:33:39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-20","CWE-74","CWE-79"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2024-45612","description":"Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.","status":"published","published":"2024-09-17T19:15:28.25Z","modified":"2026-06-17T07:54:33.89Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T14:10:26.717759Z"}],"osv":[{"id":"CVE-2024-45612","title":"Insert tag injection via canonical URL in Contao","description":"Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.","status":"published","published":"2024-09-17T18:29:27.21Z","modified":"2026-10-28T02:31:08.855955696Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"GHSA-2xpq-xp6c-5mgj","title":"Contao affected by insert tag injection via canonical URL","description":"### Impact\n\nIt is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered.\n\n### Patches\n\nUpdate to Contao 4.13.49, 5.3.15 or 5.4.3.\n\n### Workarounds\n\nDisable canonical tags in the settings of the website root page.\n\n### References\n\nhttps://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).","status":"published","published":"2024-09-17T14:59:02Z","modified":"2024-09-23T21:49:44.127021Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-20","CWE-74","CWE-79"],"updated_at":"2026-11-02T15:46:35.050232Z"}]}}