TYPO3 Cross-Site Scripting in Online Media Asset Rendering

2024-06-0719:43:19

Google

osv.dev

typo3

cross-site scripting

media asset

rendering

user input

encoding

vulnerability

backend user

server system

sftp

6.7 Medium

AI Score

Confidence

High

JSON

Failing to properly encode user input, online media asset rendering (*.youtube and *.vimeo files) is vulnerable to cross-site scripting. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.

CPENameOperatorVersion
typo3/cmseq7.6.2
typo3/cmseq8.1.0
typo3/cmseq8.4.0
typo3/cmseq8.7.2
typo3/cmseq7.6.17
typo3/cmseq7.2.0
typo3/cmseq8.1.2
typo3/cmseq9.5.1
typo3/cmseq8.0.1
typo3/cmseq9.2.1

Name	Operator	Version
typo3/cms	eq	7.6.2
typo3/cms	eq	8.1.0
typo3/cms	eq	8.4.0
typo3/cms	eq	8.7.2
typo3/cms	eq	7.6.17
typo3/cms	eq	7.2.0
typo3/cms	eq	8.1.2
typo3/cms	eq	9.5.1
typo3/cms	eq	8.0.1
typo3/cms	eq	9.2.1

Rows per page:

1-10 of 881

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-1.yaml

github.com/TYPO3/typo3

github.com/TYPO3/typo3/commit/20927adfb8aae0093508c904937e40114b92a90c

github.com/TYPO3/typo3/commit/a32a9a746f807b14571139f0cb7caa00b8d037a5

github.com/TYPO3/typo3/commit/c9174937802581bfecfaa788512a4f6e5cf8e9c7

typo3.org/security/advisory/typo3-core-sa-2018-006

6.7 Medium

AI Score

Confidence

High

JSON