Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-36665

CVE-2020-36665: Artesãos SEOTools Open Redirect vulnerability

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-36665
GHSA ID
GHSA-w2x5-hpmg-j98h
EPSS Score
0.15121%
CWE
CWE-601
Published
7/6/2023
Updated
10/20/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
artesaos/seotoolscomposer< 0.17.20.17.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The CVE explicitly identifies the eachValue function in TwitterCards.php as the affected component. The commit diff shows the vulnerability stemmed from unsanitized 'value' parameters in makeTag, which is called by eachValue. While eachValue is the entry point for processing user input, makeTag is where the lack of sanitization directly enabled the open redirect. Both functions are critical to the exploit chain. The patches in SEOMeta.php and OpenGraph.php address similar vulnerabilities but are not explicitly cited in the CVE description.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* in *rt*sãos S*OTools up to *n* in*lu*in* v*rsion *.**.*. T*is issu* *****ts t** *un*tion ****V*lu* o* t** *il* Twitt*r**r*s.p*p. T** m*nipul*tion o* t** *r*um*nt v*lu* l***s to op*n r**ir**t. Up*r**in* to v*rsion *.**.* is *

Reasoning

T** *V* *xpli*itly i**nti*i*s t** `****V*lu*` *un*tion in `Twitt*r**r*s.p*p` *s t** *****t** *ompon*nt. T** *ommit *i** s*ows t** vuln*r**ility st*mm** *rom uns*nitiz** 'v*lu*' p*r*m*t*rs in `m*k*T**`, w*i** is **ll** *y `****V*lu*`. W*il* `****V*lu*