GitHub Advisoryadvisory · Packagist

GHSA-94c2-g68f-9r98 Typo3 API XSS Vulnerability

MEDIUM Published 2022-05-17 Modified 2024-01-12 Official page ↗
Aliases
CVE-2012-3530
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-01-12

Affected packages

• Packagist typo3/cms: >= 4.5, < 4.5.19 → fixed in 4.5.19 • Packagist typo3/cms: >= 4.6, < 4.6.12 → fixed in 4.6.12 • Packagist typo3/cms: >= 4.7, < 4.7.4 → fixed in 4.7.4

Description

Incomplete blacklist vulnerability in the `t3lib_div::quoteJSvalue` API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.

Related

Alias · CVE (1)

  • CVE-2012-3530 Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References