GitHub Advisoryadvisory · Packagist

GHSA-43gj-mj2w-wh46 Cross-Site Scripting in TYPO3 CMS Form Engine

MEDIUM Published 2020-05-13 Modified 2021-01-08 Official page ↗
Aliases
CVE-2020-11064
Ecosystem
Packagist
Packages
typo3/cms-core, typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-05-13

Affected packages

• Packagist typo3/cms-core: >= 9.0.0, < 9.5.17 → fixed in 9.5.17 • Packagist typo3/cms-core: >= 10.0.0, < 10.4.2 → fixed in 10.4.2 • Packagist typo3/cms: >= 10.0.0, < 10.4.2 → fixed in 10.4.2 • Packagist typo3/cms: >= 9.0.0, < 9.5.17 → fixed in 9.5.17

Description

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML `placeholder` attributes containing data of other database records are vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described. References • https://typo3.org/security/advisory/typo3-core-sa-2020-002

Related

Alias · CVE (1)

  • CVE-2020-11064 In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References