GitHub Advisoryadvisory · Packagist

GHSA-mwqv-jff6-5v62 TYPO3 cross-site scripting (XSS) vulnerability in the RemoveXSS function and the backend

MEDIUM Published 2022-05-17 Modified 2024-02-08 Official page ↗
Aliases
CVE-2010-3715
Ecosystem
Packagist
Packages
typo3/cms-backend
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-02-08

Affected packages

• Packagist typo3/cms-backend: >= 4.2.0, < 4.2.15 → fixed in 4.2.15 • Packagist typo3/cms-backend: >= 4.3.0, < 4.3.7 → fixed in 4.3.7 • Packagist typo3/cms-backend: >= 4.4.0, < 4.4.4 → fixed in 4.4.4

Description

Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the RemoveXSS function, and allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (2) the backend.

Related

Alias · CVE (1)

  • CVE-2010-3715 Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References