GitHub Advisoryadvisory · Packagist

GHSA-59cf-m7v5-wh5w Cross-Site Scripting in SVG Sanitizer

MEDIUM Published 2020-05-13 Modified 2021-01-08 Official page ↗
Aliases
CVE-2020-11070
Ecosystem
Packagist
Packages
t3g/svg-sanitizer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-05-13

Affected packages

• Packagist t3g/svg-sanitizer: < 1.0.3 → fixed in 1.0.3

Description

Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. An updated version 1.0.3 is available from the TYPo3 extension manager and at https://extensions.typo3.org/extension/download/svg_sanitizer/1.0.3/zip/ Users of the extension are advised to update the extension as soon as possible.

Related

Alias · CVE (1)

  • CVE-2020-11070 The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References