TYPO3 Cross-Site Scripting in Form Framework validation handling

2024-05-3018:31:36

Google

osv.dev

typo3

form framework

cross-site scripting

validation

6.7 Medium

AI Score

Confidence

High

JSON

It has been discovered that the output of field validation errors in the Form Framework is vulnerable to cross-site scripting.

CPENameOperatorVersion
typo3/cms-coreeq8.7.23
typo3/cms-coreeq8.7.9
typo3/cms-coreeq8.7.10
typo3/cms-coreeq8.7.20
typo3/cms-coreeq9.1.0
typo3/cms-coreeq8.7.13
typo3/cms-coreeq8.7.27
typo3/cms-coreeq9.5.11
typo3/cms-coreeq10.2.0
typo3/cms-coreeq8.7.28

Name	Operator	Version
typo3/cms-core	eq	8.7.23
typo3/cms-core	eq	8.7.9
typo3/cms-core	eq	8.7.10
typo3/cms-core	eq	8.7.20
typo3/cms-core	eq	9.1.0
typo3/cms-core	eq	8.7.13
typo3/cms-core	eq	8.7.27
typo3/cms-core	eq	9.5.11
typo3/cms-core	eq	10.2.0
typo3/cms-core	eq	8.7.28

Rows per page:

1-10 of 471

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-12-17-1.yaml

github.com/TYPO3-CMS/core

typo3.org/security/advisory/typo3-core-sa-2019-021

6.7 Medium

AI Score

Confidence

High

JSON