TYPO3 Cross-Site Scripting in Link Handling

2024-05-3018:32:51

Google

osv.dev

typo3

cross-site scripting

link handling

vulnerabilities

url

typolink

backend

frontend

extensions

6.7 Medium

AI Score

Confidence

High

JSON

It has been discovered that t3:// URL handling and typolink functionality are vulnerable to cross-site scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering with typolink.

CPENameOperatorVersion
typo3/cms-coreeq8.7.23
typo3/cms-coreeq8.7.9
typo3/cms-coreeq8.7.10
typo3/cms-coreeq8.7.20
typo3/cms-coreeq9.1.0
typo3/cms-coreeq8.7.13
typo3/cms-coreeq8.7.27
typo3/cms-coreeq9.5.11
typo3/cms-coreeq10.2.0
typo3/cms-coreeq8.7.28

Name	Operator	Version
typo3/cms-core	eq	8.7.23
typo3/cms-core	eq	8.7.9
typo3/cms-core	eq	8.7.10
typo3/cms-core	eq	8.7.20
typo3/cms-core	eq	9.1.0
typo3/cms-core	eq	8.7.13
typo3/cms-core	eq	8.7.27
typo3/cms-core	eq	9.5.11
typo3/cms-core	eq	10.2.0
typo3/cms-core	eq	8.7.28

Rows per page:

1-10 of 471

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-12-17-2.yaml

github.com/TYPO3-CMS/core

github.com/TYPO3-CMS/core/commit/280908c9472aa5e1d9ee005327bbb9aed53f613a

github.com/TYPO3-CMS/core/commit/89f5817c09a50d8d60821158d651bd618521164e

github.com/TYPO3-CMS/core/commit/d2823a451d65ac59dd42ec54c92903d70d29c813

typo3.org/security/advisory/typo3-core-sa-2019-022

6.7 Medium

AI Score

Confidence

High

JSON