TYPO3 Cross-Site Scripting in Fluid ViewHelpers

2024-06-0717:08:39

CWE-79

GitHub Advisory Database

github.com

typo3

cross-site scripting

fluid viewhelpers

user input

templates

vulnerability

6.7 Medium

AI Score

Confidence

High

Failing to properly encode user input, templates using built-in Fluid ViewHelpers are vulnerable to cross-site scripting.

Affected configurations

Vulners

Node

typo3cms_poll_system_extensionRange<9.5.4

typo3cms_poll_system_extensionRange<8.7.23

CPENameOperatorVersion
typo3/cmslt9.5.4
typo3/cmslt8.7.23

CPE	Name	Operator	Version
	typo3/cms	lt	9.5.4
	typo3/cms	lt	8.7.23

github.com/advisories/GHSA-85ch-44w7-rf32

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-4.yaml

github.com/TYPO3/typo3/commit/732c4acfaeaa7fd193674cd4d1ca7e369e21b96f

github.com/TYPO3/typo3/commit/c94f566514eaff62dd836541c99b438ac55f6842

typo3.org/security/advisory/typo3-core-sa-2019-005

6.7 Medium

AI Score

Confidence

High