CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
30.7%
Due to a parsing issue in the upstream package masterminds/html5
, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer
.
Besides that, the upstream package masterminds/html5
provides HTML raw text elements (script
, style
, noframes
, noembed
and iframe
) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that’s why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting.
Update to typo3/html-sanitizer
versions 1.5.0 or 2.1.1 that fix the problem described.
Vendor | Product | Version | CPE |
---|---|---|---|
typo3 | typo3_cms | * | cpe:2.3:a:typo3:typo3_cms:*:*:*:*:*:*:*:* |
typo3 | html_sanitizer | * | cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:* |
github.com/advisories/GHSA-hvwx-qh2h-xcfj
github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-23499.yaml
github.com/TYPO3/html-sanitizer/pull/105
github.com/TYPO3/html-sanitizer/pull/106
github.com/TYPO3/html-sanitizer/releases/tag/v1.5.0
github.com/TYPO3/html-sanitizer/releases/tag/v2.1.1
github.com/TYPO3/html-sanitizer/security/advisories/GHSA-hvwx-qh2h-xcfj
nvd.nist.gov/vuln/detail/CVE-2022-23499
typo3.org/security/advisory/typo3-core-sa-2022-017