TYPO3 Cross-Site Scripting in Backend Modal Component

2024-05-3014:57:50

Google

osv.dev

typo3

backend

cross-site scripting

vulnerability

user input

modal windows

exploitation

6.7 Medium

AI Score

Confidence

High

JSON

Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.

CPENameOperatorVersion
typo3/cms-coreeq8.7.9
typo3/cms-coreeq8.7.10
typo3/cms-coreeq8.7.20
typo3/cms-coreeq9.1.0
typo3/cms-coreeq8.7.13
typo3/cms-coreeq9.4.0
typo3/cms-coreeq9.3.3
typo3/cms-coreeq8.7.14
typo3/cms-coreeq8.7.15
typo3/cms-coreeq8.7.16

Name	Operator	Version
typo3/cms-core	eq	8.7.9
typo3/cms-core	eq	8.7.10
typo3/cms-core	eq	8.7.20
typo3/cms-core	eq	9.1.0
typo3/cms-core	eq	8.7.13
typo3/cms-core	eq	9.4.0
typo3/cms-core	eq	9.3.3
typo3/cms-core	eq	8.7.14
typo3/cms-core	eq	8.7.15
typo3/cms-core	eq	8.7.16

Rows per page:

1-10 of 251

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2018-12-11-2.yaml

github.com/TYPO3-CMS/core

github.com/TYPO3-CMS/core/commit/3c1deac4db61ac1ac4231799beb1f49c28eb2b4d

github.com/TYPO3-CMS/core/commit/983ecc4ea3a841aca7ff2bb1d2f0e0318c3646b3

typo3.org/security/advisory/typo3-core-sa-2018-007

6.7 Medium

AI Score

Confidence

High

JSON