CVE-2022-24980

An issue was discovered in the Kitodo.Presentation aka dif extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to vie...

Kitodo Presentation 代码问题漏洞

Kitodo Presentation is a feature-rich framework for building METS or IIIF-based digital libraries. A code issue vulnerability exists in Kitodo Presentation that stems from the product's failure to adequately validate user-supplied input in eID scripts. A remote attacker could use this vulnerabili...

Cross-site Scripting (XSS)

kitodo/presentation is vulnerable to cross-site scripting XSS. The vulnerability exists as it does not sanitize the value of $piVar in ListView.php, and Navigation.php...