Lucene search

MitreCVE-2013-7082

HistoryDec 21, 2013 - 12:55 a.m.

CVE-2013-7082

2013-12-2100:55:04

CWE-79

mitre

web.nvd.nist.gov

cve-2013-7082

cross-site scripting

xss

typo3 flow

vulnerability

web security

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

60.3%

JSON

Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow (formerly FLOW3) 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.

Affected configurations

Nvd

Node

typo3flowMatch1.1.0

typo3flowMatch2.0.0

VendorProductVersionCPE
typo3flow1.1.0cpe:2.3:a:typo3:flow:1.1.0:*:*:*:*:*:*:*
typo3flow2.0.0cpe:2.3:a:typo3:flow:2.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typo3	flow	1.1.0	cpe:2.3:a:typo3:flow:1.1.0:::::::*
typo3	flow	2.0.0	cpe:2.3:a:typo3:flow:2.0.0:::::::*

References

osvdb.org/100825

secunia.com/advisories/55996

typo3.org/teams/security/security-bulletins/typo3-flow/typo3-flow-sa-2013-001

exchange.xforce.ibmcloud.com/vulnerabilities/89614

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

60.3%

JSON

Related for CVE-2013-7082