Lucene search

K

GoogleOSV:GHSA-HQ37-RFJC-MR8H

HistoryJun 05, 2024 - 3:03 p.m.

Cross-Site Scripting (XSS) in TYPO3 Backend

2024-06-0515:03:28

Google

osv.dev

1

cross-site scripting

typo3

backend

input encoding

vulnerability

user account

plugins

AI Score

7

Confidence

High

Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability.

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2016-09-14-1.yaml

github.com/TYPO3/typo3

typo3.org/security/advisory/typo3-core-sa-2016-021

AI Score

7

Confidence

High