TYPO3 Cross-Site Scripting in Backend Modal Component

2024-06-0719:44:49

Google

osv.dev

typo3

cross-site scripting

backend

modal

vulnerability

user input

notification

exploit

6.7 Medium

AI Score

Confidence

High

JSON

Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.

CPENameOperatorVersion
typo3/cmseq7.6.2
typo3/cmseq8.1.0
typo3/cmseq8.4.0
typo3/cmseq8.7.2
typo3/cmseq7.6.17
typo3/cmseq7.2.0
typo3/cmseq8.1.2
typo3/cmseq9.5.1
typo3/cmseq8.0.1
typo3/cmseq9.2.1

Name	Operator	Version
typo3/cms	eq	7.6.2
typo3/cms	eq	8.1.0
typo3/cms	eq	8.4.0
typo3/cms	eq	8.7.2
typo3/cms	eq	7.6.17
typo3/cms	eq	7.2.0
typo3/cms	eq	8.1.2
typo3/cms	eq	9.5.1
typo3/cms	eq	8.0.1
typo3/cms	eq	9.2.1

Rows per page:

1-10 of 881

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-2.yaml

github.com/TYPO3/typo3

github.com/TYPO3/typo3/commit/02cd5c97228cba477d16c68e28309ce25c433ce9

github.com/TYPO3/typo3/commit/89a38ad0ef9411745954f53f29bea5b8ce81cd32

github.com/TYPO3/typo3/commit/c35646c3f7795a4a7b0046a88f146b490fa4883c

typo3.org/security/advisory/typo3-core-sa-2018-007

6.7 Medium

AI Score

Confidence

High

JSON