GitHub Advisoryadvisory · Packagist

GHSA-jr79-65xr-q7cx TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms

MEDIUM Published 2022-05-17 Modified 2024-02-07 Official page ↗
Aliases
CVE-2010-3659
Ecosystem
Packagist
Packages
typo3/cms-backend
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-02-07

Affected packages

• Packagist typo3/cms-backend: >= 4.1.0, < 4.1.14 → fixed in 4.1.14 • Packagist typo3/cms-backend: >= 4.2.0, < 4.2.13 → fixed in 4.2.13 • Packagist typo3/cms-backend: >= 4.3.0, < 4.3.4 → fixed in 4.3.4 • Packagist typo3/cms-backend: >= 4.4.0, < 4.4.1 → fixed in 4.4.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified parameters to unknown backend forms.

Related

Alias · CVE (1)

  • CVE-2010-3659 Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References