{"action":"Upgrade contao/core-bundle to 4.13.3 or later.","affected":[{"fixed":"4.13.3","introduced":"4.13.0"}],"component":"contao/core-bundle","cve_ids":["CVE-2022-24899"],"ecosystem":"Packagist","epss":0.04478,"exploited":false,"fixed_versions":["4.13.3"],"ghsa_id":"GHSA-m8x6-6r63-qvj2","id":"tcs_01M5KF5C0VP93AWNQAQEEK9XAZ","modified_at":"2025-04-17T13:20:00.766389Z","published_at":"2022-05-20T19:54:56Z","references":["https://osv.dev/vulnerability/GHSA-m8x6-6r63-qvj2","https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2","https://nvd.nist.gov/vuln/detail/CVE-2022-24899","https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c","https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html","https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2022-24899.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2022-24899.yaml","https://github.com/contao/contao"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-m8x6-6r63-qvj2","url":"https://osv.dev/vulnerability/GHSA-m8x6-6r63-qvj2"}],"summary":"Cross site scripting via canonical tag in Contao"}