TYPO3 Cross-Site Scripting in Fluid ViewHelpers

2024-05-3015:46:01

CWE-79

GitHub Advisory Database

github.com

typo3

cross-site scripting

fluid viewhelpers

vulnerability

7 High

AI Score

Confidence

High

Failing to properly encode user input, templates using built-in Fluid ViewHelpers are vulnerable to cross-site scripting.

Affected configurations

Vulners

Node

typo3cms_poll_system_extensionRange<9.5.4

typo3cms_poll_system_extensionRange<8.7.23

CPENameOperatorVersion
typo3/cms-corelt9.5.4
typo3/cms-corelt8.7.23

CPE	Name	Operator	Version
	typo3/cms-core	lt	9.5.4
	typo3/cms-core	lt	8.7.23

github.com/advisories/GHSA-22q7-cg4r-p9mx

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-01-22-4.yaml

typo3.org/security/advisory/typo3-core-sa-2019-005

7 High

AI Score

Confidence

High