GitHub Advisoryadvisory · Packagist

GHSA-2hp4-8h6h-93rr Typo3 Backend History Module Vulnerable to XSS

MEDIUM Published 2022-05-17 Modified 2024-01-12 Official page ↗
Aliases
CVE-2012-6146
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-01-12

Affected packages

• Packagist typo3/cms: >= 4.5, < 4.5.21 → fixed in 4.5.21 • Packagist typo3/cms: >= 4.6, < 4.6.14 → fixed in 4.6.14 • Packagist typo3/cms: >= 4.7, < 4.7.6 → fixed in 4.7.6

Description

The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL.

Related

Alias · CVE (1)

  • CVE-2012-6146 The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References