Cross-Site Scripting in Content Preview

2021-03-1600:00:00

TYPO3 Association

typo3.org

136

0.001 Low

EPSS

Percentile

26.4%

JSON

It has been discovered that content elements of type menu are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability.

CPENameOperatorVersion
typo3 cmsge7.0.0
typo3 cmsle7.6.50
typo3 cmsge8.0.0
typo3 cmsle8.7.39
typo3 cmsge9.0.0
typo3 cmsle9.5.16
typo3 cmsge10.0.0
typo3 cmsle10.4.1
typo3 cmsge11.0.0
typo3 cmsle11.1.0

Name	Operator	Version
typo3 cms	ge	7.0.0
typo3 cms	le	7.6.50
typo3 cms	ge	8.0.0
typo3 cms	le	8.7.39
typo3 cms	ge	9.0.0
typo3 cms	le	9.5.16
typo3 cms	ge	10.0.0
typo3 cms	le	10.4.1
typo3 cms	ge	11.0.0
typo3 cms	le	11.1.0

0.001 Low

EPSS

Percentile

26.4%

JSON

Related for TYPO3-CORE-SA-2021-008