Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-gm48-5kg3-r7c8
Vulnerability ID VCID-gm48-5kg3-r7c8
Aliases CVE-2024-45612
GHSA-2xpq-xp6c-5mgj
Summary Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-20 Improper Input Validation
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0055 https://api.first.org/data/v1/epss?cve=CVE-2024-45612
cvssv3.1 5.3 https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
cvssv4 6.9 https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
generic_textual MODERATE https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
ssvc Track https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-2xpq-xp6c-5mgj
cvssv3.1 5.3 https://github.com/contao/contao
cvssv4 6.9 https://github.com/contao/contao
generic_textual MODERATE https://github.com/contao/contao
cvssv3.1 5.3 https://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2
cvssv4 6.9 https://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2
generic_textual MODERATE https://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2
cvssv3.1 5.3 https://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66
cvssv4 6.9 https://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66
generic_textual MODERATE https://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66
cvssv3.1 5.3 https://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590
cvssv4 6.9 https://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590
generic_textual MODERATE https://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590
cvssv3.1 5.3 https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj
cvssv3.1_qr MODERATE https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj
cvssv4 6.9 https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj
generic_textual MODERATE https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj
ssvc Track https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2024-45612
cvssv4 6.9 https://nvd.nist.gov/vuln/detail/CVE-2024-45612
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-45612
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-45612
https://github.com/contao/contao
https://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2
https://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66
https://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590
CVE-2024-45612 https://nvd.nist.gov/vuln/detail/CVE-2024-45612
GHSA-2xpq-xp6c-5mgj https://github.com/advisories/GHSA-2xpq-xp6c-5mgj
GHSA-2xpq-xp6c-5mgj https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj
insert-tag-injection-via-canonical-urls https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-18T14:06:58Z/ Found at https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/contao/contao
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/contao/contao
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/contao/contao/commit/1c28e9ac7a7b915134962a59681a8701a44ccbe2
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/contao/contao/commit/d105224e14ddc84f27cd8802b553369decdcbe66
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/contao/contao/commit/ffe05cda5310dc2bd259d1391197f3849dab8590
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-18T14:06:58Z/ Found at https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-45612
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-45612
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.6844
EPSS Score 0.0055
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:32:33.024610+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/45xxx/CVE-2024-45612.json 38.6.0