Cross-Site Scripting (XSS) in TYPO3 component CSS styled content

2024-06-0414:48:42

CWE-79

GitHub Advisory Database

github.com

cross-site scripting

typo3

css styled content

user input

html

javascript

security vulnerability

authenticated editors

AI Score

6.8

Confidence

High

JSON

Failing to properly encode user input, the CSS styled content component is susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript.

Affected configurations

Vulners

Node

typo3typo3_cmsRange7.6.0–7.6.4

typo3typo3_cmsRange6.2.0–6.2.19

VendorProductVersionCPE
typo3typo3_cms*cpe:2.3:a:typo3:typo3_cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typo3	typo3_cms	*	cpe:2.3:a:typo3:typo3_cms::::::::

References

github.com/advisories/GHSA-8j9v-4hhh-x43c

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2016-02-23-3.yaml

typo3.org/security/advisory/typo3-core-sa-2016-007

AI Score

6.8

Confidence

High

JSON