GitHub Advisoryadvisory · Packagist

GHSA-w3v6-r62r-fvqh Typo3 API XSS Vulnerabilities

MEDIUM Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2012-1608
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
Weaknesses
CWE-20
Reviewed
2023-08-29

Affected packages

• Packagist typo3/cms: >= 4.4.0, < 4.4.14 → fixed in 4.4.14 • Packagist typo3/cms: >= 4.5.0, < 4.5.14 → fixed in 4.5.14 • Packagist typo3/cms: >= 4.6.0, < 4.6.7 → fixed in 4.6.7

Description

The `t3lib_div::RemoveXSS` API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.

Related

Alias · CVE (1)

  • CVE-2012-1608 The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References