Cross-Site Scripting in TYPO3 component Indexed Search

2024-06-0314:41:04

Google

osv.dev

cross-site scripting

typo3

indexed search

vulnerability

html injection

security

6.9 Medium

AI Score

Confidence

High

JSON

Failing to properly encode editor input, the search result view of indexed_search is susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML.

CPENameOperatorVersion
typo3/cmseq6.2.10-rc1
typo3/cmseq6.2.15
typo3/cmseq6.2.0
typo3/cmseq6.2.4
typo3/cmseq6.2.6
typo3/cmseq6.2.9
typo3/cmseq6.2.14
typo3/cmseq6.2.11
typo3/cmseq6.2.13
typo3/cmseq6.2.5

Name	Operator	Version
typo3/cms	eq	6.2.10-rc1
typo3/cms	eq	6.2.15
typo3/cms	eq	6.2.0
typo3/cms	eq	6.2.4
typo3/cms	eq	6.2.6
typo3/cms	eq	6.2.9
typo3/cms	eq	6.2.14
typo3/cms	eq	6.2.11
typo3/cms	eq	6.2.13
typo3/cms	eq	6.2.5

Rows per page:

1-10 of 171

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2015-12-15-5.yaml

github.com/TYPO3/typo3

typo3.org/security/advisory/typo3-core-sa-2015-015

typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015

6.9 Medium

AI Score

Confidence

High

JSON