TYPO3 Cross-Site Scripting in Backend Modal Component

2024-05-3014:57:50

CWE-79

GitHub Advisory Database

github.com

typo3

backend

cross-site scripting

user input

modal component

vulnerability

security

account

AI Score

6.7

Confidence

High

JSON

Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.

Affected configurations

Vulners

Node

typo3cms-coreRange7.1.0–7.6.32

typo3cms-coreRange9.0.0–9.5.2

typo3cms-coreRange8.0.0–8.7.21

VendorProductVersionCPE
typo3cms-core*cpe:2.3:a:typo3:cms-core:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typo3	cms-core	*	cpe:2.3:a:typo3:cms-core::::::::

References

github.com/advisories/GHSA-g4c9-qfvw-fmr4

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2018-12-11-2.yaml

github.com/TYPO3-CMS/core/commit/3c1deac4db61ac1ac4231799beb1f49c28eb2b4d

github.com/TYPO3-CMS/core/commit/983ecc4ea3a841aca7ff2bb1d2f0e0318c3646b3

typo3.org/security/advisory/typo3-core-sa-2018-007

AI Score

6.7

Confidence

High

JSON