XML External Entity (XXE) Processing in TYPO3 Core

2024-06-0414:47:00

GitHub Advisory Database

github.com

xml processing

typo3 cms

xee processing

internal content

external content

file injection

denial of service

AI Score

6.9

Confidence

High

JSON

All XML processing within the TYPO3 CMS are vulnerable to XEE processing. This can lead to load internal and/or external (file) content within an XML structure. Furthermore it is possible to inject arbitrary files for an XML Denial of Service attack. For more information on that topic see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing.

Affected configurations

Vulners

Node

typo3typo3_cmsRange7.6.0–7.6.4

typo3typo3_cmsRange6.2.0–6.2.19

VendorProductVersionCPE
typo3typo3_cms*cpe:2.3:a:typo3:typo3_cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typo3	typo3_cms	*	cpe:2.3:a:typo3:typo3_cms::::::::

References

github.com/advisories/GHSA-qffc-gwpp-m2xr

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2016-02-23-1.yaml

typo3.org/security/advisory/typo3-core-sa-2016-005

AI Score

6.9

Confidence

High

JSON