GitHub Advisoryadvisory · Packagist

GHSA-h86g-796f-hhfq Typo3 XSS Vulnerabilities

MEDIUM Published 2022-04-22 Modified 2024-01-12 Official page ↗
Aliases
CVE-2011-4632
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-01-12

Affected packages

• Packagist typo3/cms: < 4.3.12 → fixed in 4.3.12 • Packagist typo3/cms: >= 4.4.0, < 4.4.9 → fixed in 4.4.9 • Packagist typo3/cms: >= 4.5.0, < 4.5.4 → fixed in 4.5.4

Description

Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message.

Related

Alias · CVE (1)

  • CVE-2011-4632 Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References