GitHub Advisoryadvisory · Packagist
GHSA-6fc6-cj2j-h22x TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend
MEDIUM
Official page ↗
- Ecosystem
- Packagist
- Packages
- typo3/cms
- Severity
- Moderate
- Reviewed
- 2024-06-03
Affected packages
• Packagist typo3/cms: >= 6.2.0, < 6.2.16 → fixed in 6.2.16
• Packagist typo3/cms: >= 7.0.0, < 7.6.1 → fixed in 7.6.1
Description
Failing to properly encode editor input, several frontend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML.