The vulnerability of the GeneralUtility::getIndpEnv() function in the TYPO3 content management system allows attackers to perform cross-site scripting attacks.

TYPO3 vulnerability in GeneralUtility::getIndpEnv enables cross-site scripting via a crafted hypertext page.

Reporter	Title	Published	Views	Family All 20
Circl	CVE-2023-24814	7 Feb 202322:23	–	circl
CNNVD	TYPO3 跨站脚本漏洞	7 Feb 202300:00	–	cnnvd
CVE	CVE-2023-24814	7 Feb 202318:14	–	cve
Cvelist	CVE-2023-24814 Persisted Cross-Site Scripting in Frontend Rendering in typo3	7 Feb 202318:14	–	cvelist
EUVD	EUVD-2023-0784	3 Oct 202520:07	–	euvd
Friends Of PHP	TYPO3-CORE-SA-2023-001: Persisted Cross-Site Scripting in Frontend Rendering	7 Feb 202309:24	–	friendsofphp
Friends Of PHP	TYPO3-CORE-SA-2023-001: Persisted Cross-Site Scripting in Frontend Rendering	7 Feb 202309:24	–	friendsofphp
Github Security Blog	TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering	8 Feb 202321:33	–	github
NVD	CVE-2023-24814	7 Feb 202319:15	–	nvd
OpenVAS	TYPO3 XSS Vulnerability (TYPO3-core-sa-2023-001)	8 Feb 202300:00	–	openvas

Vulners

Node

typo3 typo3Range8.7.0–9.7.51

typo3 typo3Range9.0.0–9.5.40

typo3 typo3Range10.0.0–10.4.36

typo3 typo3Range11.0.0–11.5.23

typo3 typo3Range12.0.0–12.2.0

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-24814
docs	www.docs.typo3.org/m/typo3/reference-typoscript/main/en-us/Setup/Config/Index.html
github	www.github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/core/Classes/Utility/GeneralUtility.php
github	www.github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php
github	www.github.com/TYPO3/typo3/commit/0005a6fd86ab97eff8bf2e3a5828bf0e7cb6263a
github	www.github.com/TYPO3/typo3/security/advisories/GHSA-r4f8-f93x-5qh3
typo3	www.typo3.org/security/advisory/typo3-core-sa-2023-001
typo3	www.typo3.org/security/advisory/typo3-psa-2023-001
web	www.web.nvd.nist.gov/view/vuln/detail

01 Mar 2023 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 28

CVSS 38.8

EPSS0.00831