CVE-2021-31779 Server-Side Request Forgery in yoast_seo
An attacker with a backend account can exploit Server-Side Request Forgery in the Yoast SEO extension to access internal resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-31779?
CVE-2021-31779 is a medium-severity server-side request forgery vulnerability in n/a, published on 28 Apr 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.
Weakness: CWE-918
Which versions are affected by CVE-2021-31779?
2 open source packages ship an affected version, including yoast-seo-for-typo3/yoast_seo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yoast-seo-for-typo3/yoast_seo Packagist | All versions | 7.2.1 |
yoast-seo-for-typo3/yoast_seo Packagist | All versions | 7.2.1 |
Products include Yoast Yoast Seo.
How do I fix CVE-2021-31779?
Upgrade yoast-seo-for-typo3/yoast_seo to 7.2.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-31779 being exploited?
There is no known exploitation of CVE-2021-31779 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-13478 Cross-site scripting in n/a
- CVE-2023-32300 WordPress Yoast SEO: Local Plugin <= 14.8 is vulnerable to Cross Site Scripting (XSS)
- CVE-2018-19370 Race condition in n/a
- CVE-2023-28785 WordPress Yoast SEO: Local Plugin <= 14.9 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-40680 WordPress Yoast SEO Plugin <= 21.0 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-m2q4-qghh-p9cq.