Cross-Site Scripting (XSS) vulnerability in typolinks

2024-06-0515:04:23

CWE-79

GitHub Advisory Database

github.com

typo3

xss vulnerability

typolinks

authorized editors

data commands

url scheme

6.7 Medium

AI Score

Confidence

High

JSON

All link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized editors can insert data commands by using the url scheme “data:”.

Affected configurations

Vulners

Node

typo3cms_poll_system_extensionRange<8.2.1

typo3cms_poll_system_extensionRange<7.6.10

typo3cms_poll_system_extensionRange<6.2.26

CPENameOperatorVersion
typo3/cmslt8.2.1
typo3/cmslt7.6.10
typo3/cmslt6.2.26

Name	Operator	Version
typo3/cms	lt	8.2.1
typo3/cms	lt	7.6.10
typo3/cms	lt	6.2.26

References

github.com/advisories/GHSA-p5c5-gmj4-g48f

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2016-07-19-5.yaml

typo3.org/security/advisory/typo3-core-sa-2016-018

6.7 Medium

AI Score

Confidence

High

JSON