GitHub Advisoryadvisory · Packagist

GHSA-4j77-gg36-9864 Cross-Site Scripting in TYPO3 CMS Link Handling

MEDIUM Published 2020-05-13 Modified 2021-01-08 Official page ↗
Aliases
CVE-2020-11065
Ecosystem
Packagist
Packages
typo3/cms-core, typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-05-13

Affected packages

• Packagist typo3/cms-core: >= 10.0.0, < 10.4.2 → fixed in 10.4.2 • Packagist typo3/cms-core: >= 9.0.0, < 9.5.17 → fixed in 9.5.17 • Packagist typo3/cms: >= 10.0.0, < 10.4.2 → fixed in 10.4.2 • Packagist typo3/cms: >= 9.0.0, < 9.5.17 → fixed in 9.5.17

Description

It has been discovered that link tags generated by `typolink` functionality are vulnerable to cross-site scripting - properties being assigned as HTML attributes have not been parsed correctly. Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described. References • https://typo3.org/security/advisory/typo3-core-sa-2020-003

Related

Alias · CVE (1)

  • CVE-2020-11065 In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References