Cross site scripting

2021-07-2016:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

21.4%

JSON

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for backend layouts are not properly encoded, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this vulnerability.

CPENameOperatorVersion
typo3ge10.0.0
typo3le10.4.17
typo3ge9.0.0
typo3le9.5.28
typo3ge11.0.0
typo3le11.3.0
typo3ge8.0.0
typo3le8.7.40

Name	Operator	Version
typo3	ge	10.0.0
typo3	le	10.4.17
typo3	ge	9.0.0
typo3	le	9.5.28
typo3	ge	11.0.0
typo3	le	11.3.0
typo3	ge	8.0.0
typo3	le	8.7.40

References

github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-rgcg-28xm-8mmw

typo3.org/security/advisory/typo3-core-sa-2021-011

0.001 Low

EPSS

Percentile

21.4%

JSON

Related for PRION:CVE-2021-32669