Lucene search

GitHub Advisory DatabaseGHSA-VQQX-JW6P-Q3RF

HistoryDec 21, 2020 - 4:28 p.m.

Cross-Site Scripting in Fluid view helpers

2020-12-2116:28:11

CWE-79

GitHub Advisory Database

github.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

44.8%

JSON

> ### Meta
> * CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.7)
> * CWE-79

Problem

It has been discovered that system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers.

&lt;f:form ... fieldNamePrefix="{payload}" /&gt;
&lt;f:be.labels.csh ... label="{payload}" /&gt;
&lt;f:be.menus.actionMenu ... label="{payload}" /&gt;

Solution

Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

Credits

Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 security team members Helmut Hummel & Oliver Hader who fixed the issue.

References

TYPO3-CORE-SA-2020-010

Affected configurations

Vulners

Node

typo3cms_poll_system_extensionRange<8.7.38

typo3cms_poll_system_extensionRange<9.5.23

typo3cms_poll_system_extensionRange<10.4.10

typo3cms_poll_system_extensionRange<8.7.38

typo3cms_poll_system_extensionRange<10.4.10

typo3cms_poll_system_extensionRange<9.5.23

CPENameOperatorVersion
typo3/cmslt8.7.38
typo3/cmslt9.5.23
typo3/cmslt10.4.10
typo3/cms-corelt8.7.38
typo3/cms-corelt10.4.10
typo3/cms-corelt9.5.23

Name	Operator	Version
typo3/cms	lt	8.7.38
typo3/cms	lt	9.5.23
typo3/cms	lt	10.4.10
typo3/cms-core	lt	8.7.38
typo3/cms-core	lt	10.4.10
typo3/cms-core	lt	9.5.23

References

github.com/advisories/GHSA-vqqx-jw6p-q3rf

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-26227.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-26227.yaml

github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-vqqx-jw6p-q3rf

nvd.nist.gov/vuln/detail/CVE-2020-26227

packagist.org/packages/typo3/cms-core

typo3.org/security/advisory/typo3-core-sa-2020-010

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

44.8%

JSON

Related for GHSA-VQQX-JW6P-Q3RF