Cross-Site Scripting in Fluid view helpers

2020-11-1700:00:00

TYPO3 Association

typo3.org

0.001 Low

EPSS

Percentile

44.8%

JSON

It has been discovered that system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers.

CPENameOperatorVersion
typo3 cmsge10.0.0
typo3 cmsle10.4.9
typo3 cmsge9.0.0
typo3 cmsle9.5.22
typo3 cmsge8.7.0
typo3 cmsle8.7.37
typo3 cmsge7.6.0
typo3 cmsle7.6.47
typo3 cmsge6.2.0
typo3 cmsle6.2.53

Name	Operator	Version
typo3 cms	ge	10.0.0
typo3 cms	le	10.4.9
typo3 cms	ge	9.0.0
typo3 cms	le	9.5.22
typo3 cms	ge	8.7.0
typo3 cms	le	8.7.37
typo3 cms	ge	7.6.0
typo3 cms	le	7.6.47
typo3 cms	ge	6.2.0
typo3 cms	le	6.2.53

0.001 Low

EPSS

Percentile

44.8%

JSON

Related for TYPO3-CORE-SA-2020-010