Cross-Site Scripting (XSS) in TYPO3 Backend

2024-06-0515:03:28

CWE-79

GitHub Advisory Database

github.com

cross-site scripting

typo3

backend

user input

encoding

vulnerability

exploit

user account

edit plugins

AI Score

Confidence

High

JSON

Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability.

Affected configurations

Vulners

Node

typo3typo3_cmsRange8.0.0–8.3.1

typo3typo3_cmsRange7.6.0–7.6.11

typo3typo3_cmsRange6.2.0–6.2.27

VendorProductVersionCPE
typo3typo3_cms*cpe:2.3:a:typo3:typo3_cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typo3	typo3_cms	*	cpe:2.3:a:typo3:typo3_cms::::::::

References

github.com/advisories/GHSA-hq37-rfjc-mr8h

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2016-09-14-1.yaml

typo3.org/security/advisory/typo3-core-sa-2016-021

AI Score

Confidence

High

JSON