Cross site scripting

2019-11-0617:15:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.2%

JSON

Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the “JSwindow” property of the typolink function.

CPENameOperatorVersion
typo3ge4.5.0
typo3lt4.5.4
typo3ge4.3.0
typo3lt4.3.12
typo3ge4.4.0
typo3lt4.4.9

Name	Operator	Version
typo3	ge	4.5.0
typo3	lt	4.5.4
typo3	ge	4.3.0
typo3	lt	4.3.12
typo3	ge	4.4.0
typo3	lt	4.4.9

References

security-tracker.debian.org/tracker/CVE-2011-4626

typo3.org/security/advisory/typo3-core-sa-2011-001/