GitHub Advisoryadvisory · Packagist

GHSA-qffc-gwpp-m2xr XML External Entity (XXE) Processing in TYPO3 Core

HIGH Published 2024-06-04 Modified 2024-06-04 Official page ↗
Ecosystem
Packagist
Packages
typo3/cms
Severity
High
Reviewed
2024-06-04

Affected packages

• Packagist typo3/cms: >= 6.2.0, < 6.2.19 → fixed in 6.2.19 • Packagist typo3/cms: >= 7.6.0, < 7.6.4 → fixed in 7.6.4

Description

All XML processing within the TYPO3 CMS are vulnerable to XEE processing. This can lead to load internal and/or external (file) content within an XML structure. Furthermore it is possible to inject arbitrary files for an XML Denial of Service attack. For more information on that topic see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing.

References