GitHub Advisoryadvisory · Packagist

GHSA-vc74-c4m6-9979 TYPO3 Flow Cross-site scripting (XSS) vulnerability

MEDIUM Published 2022-05-17 Modified 2023-08-28 Official page ↗
Aliases
CVE-2013-7082
Ecosystem
Packagist
Packages
neos/flow, typo3/flow
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2023-08-28

Affected packages

• Packagist neos/flow: >= 1.1.0, < 1.1.1 → fixed in 1.1.1 • Packagist neos/flow: >= 2.0.0, < 2.0.1 → fixed in 2.0.1 • Packagist typo3/flow: >= 1.1.0, < 1.1.1 → fixed in 1.1.1 • Packagist typo3/flow: >= 2.0.0, < 2.0.1 → fixed in 2.0.1

Description

Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow (formerly FLOW3) 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.

Related

Alias · CVE (1)

  • CVE-2013-7082 Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow (formerly FLOW3) 1.1.x… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References