Typo3 Cross-Site Scripting in Language Pack Handling

2024-06-0517:23:19

CWE-79

GitHub Advisory Database

github.com

typo3

cross-site scripting

language pack

install tool

vulnerability

AI Score

6.4

Confidence

High

Failing to properly encode information from external sources, language pack handling in the install tool is vulnerable to cross-site scripting.

Affected configurations

Vulners

Node

typo3typo3_cmsRange9.0.0–9.5.4

VendorProductVersionCPE
typo3typo3_cms*cpe:2.3:a:typo3:typo3_cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typo3	typo3_cms	*	cpe:2.3:a:typo3:typo3_cms::::::::

github.com/advisories/GHSA-259v-xm34-p7fr

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-8.yaml

typo3.org/security/advisory/typo3-core-sa-2019-004

AI Score

6.4

Confidence

High