GitHub Advisoryadvisory · Packagist
GHSA-3mqf-fwc6-vwqw TYPO3 Cross-site scripting (XSS) vulnerability in the FORM content object
LOW
Official page ↗
- Aliases
- CVE-2010-5098
- Ecosystem
- Packagist
- Packages
- typo3/cms-frontend
- Severity
- Low
- Weaknesses
- CWE-79
- Reviewed
- 2024-02-07
Affected packages
• Packagist typo3/cms-frontend: >= 4.2.0, < 4.2.16 → fixed in 4.2.16
• Packagist typo3/cms-frontend: >= 4.4.0, < 4.4.5 → fixed in 4.4.5
• Packagist typo3/cms-frontend: >= 4.3.0, < 4.3.9 → fixed in 4.3.9
Description
Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Related
Alias · CVE (1)
- CVE-2010-5098 Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2010-5098 advisory
- https://github.com/TYPO3/typo3/commit/3c5d15233ca765fabeac21f0600d831595d31cd8 web
- https://github.com/TYPO3/typo3/commit/4e8bd7a15681c0683196984e871f60f0646ea2b6 web
- https://github.com/TYPO3/typo3/commit/6d17fe7cef30b09a65e0c2d54f8871ec3ddfc67e web
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64179 web
- https://github.com/TYPO3-CMS/frontend package
- https://web.archive.org/web/20101229020821/http://secunia.com/advisories/35770 web
- https://web.archive.org/web/20111025222220/http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-022 web
- https://web.archive.org/web/20111223211753/http://www.securityfocus.com/bid/45470 web
- http://www.openwall.com/lists/oss-security/2011/01/13/2 web
- http://www.openwall.com/lists/oss-security/2012/05/10/7 web
- http://www.openwall.com/lists/oss-security/2012/05/11/3 web
- http://www.openwall.com/lists/oss-security/2012/05/12/5 web