GitHub Advisoryadvisory · Packagist

GHSA-8c25-vj2w-p72j TYPO3 Cross-Site Scripting in Frontend User Login

MEDIUM Published 2024-05-30 Modified 2024-05-30 Official page ↗
Ecosystem
Packagist
Packages
typo3/cms-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-05-30

Affected packages

• Packagist typo3/cms-core: >= 8.0.0, < 8.7.21 → fixed in 8.7.21 • Packagist typo3/cms-core: >= 9.0.0, < 9.5.2 → fixed in 9.5.2 • Packagist typo3/cms-core: >= 7.1.0, < 7.6.32 → fixed in 7.6.32

Description

Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile. Template patterns that are affected are • ###FEUSER_[fieldName]### using system extension felogin • for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References