GitHub Advisoryadvisory · Packagist
GHSA-5cxf-xx9j-54jc Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend
MEDIUM
Official page ↗
- Ecosystem
- Packagist
- Packages
- typo3/cms
- Severity
- Moderate
- Reviewed
- 2024-06-03
Affected packages
• Packagist typo3/cms: >= 6.2.0, < 6.2.16 → fixed in 6.2.16
• Packagist typo3/cms: >= 7.0.0, < 7.6.1 → fixed in 7.6.1
Description
Failing to properly encode user input, several backend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript.