TI-2020-18857 Aliases CVE-2020-36665 GHSA-w2x5-hpmg-j98h

Artesãos SEOTools TwitterCards.php eachValue redirect

LOW 28CWE-601Published 2023-03-04 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

A vulnerability was found in Artesãos SEOTools up to 0.17.1 and classified as critical. This issue affects the function eachValue of the file TwitterCards.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The identifier of the patch is ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The identifier VDB-222233 was assigned to this vulnerability.

Why it matters now

EPSS 0.00587 48th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed artesaos/seotools (Packagist): 0.17.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Artesãos	SEOTools	0.17.0; 0.17.1	—	No fix listed	CNA
—	artesaos/seotools (Packagist)	before 0.17.2	0.17.2	Patch available	GHSA-w2x5-hpmg-j98h

SEOTools VendorArtesãos Affected 0.17.0; 0.17.1 Fixed in — No fix listed CNA
artesaos/seotools (Packagist) Vendor— Affected before 0.17.2 Fixed in 0.17.2 Patch available GHSA-w2x5-hpmg-j98h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:seotool_project:seotool::::::laravel::*	before 0.17.2	Vulnerable	Artesãos

cpe:2.3:a:seotool_project:seotool:*:*:*:*:*:laravel:*:* Versions before 0.17.2 Vulnerable ·Artesãos

Remediation

Fix · GHSA-w2x5-hpmg-j98h artesaos/seotools (Packagist) Fixed in 0.17.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-36665
2026-10-03 Alias added: GHSA-w2x5-hpmg-j98h

References

Exploit 1

https://github.com/artesaos/seotools/pull/201

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2020-36665

Other 1

https://github.com/artesaos/seotools

TI-2020-18856 Artesãos SEOTools SEOMeta.php setTitle redirect CVSS 3.1MEDIUM 6.1
TI-2020-18855 Artesãos SEOTools OpenGraph.php makeTag redirect CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences