GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-7733-hjv6-4h47medium4.7

Cross-Site Scripting in ternary conditional operator

Impact

> Meta > CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0) > CWE-79

Source excerpt · OSV

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

typo3fluid/fluid Packagist
Affected rangeRecorded fix
From 2.0.0 before 2.0.5Ecosystem versions2.0.5
From 2.1.0 before 2.1.4Ecosystem versions2.1.4
From 2.2.0 before 2.2.1Ecosystem versions2.2.1
From 2.3.0 before 2.3.5Ecosystem versions2.3.5
From 2.4.0 before 2.4.1Ecosystem versions2.4.1
From 2.5.0 before 2.5.5Ecosystem versions2.5.5
From 2.6.0 before 2.6.1Ecosystem versions2.6.1

Version evidence: OSV · GHSA-7733-hjv6-4h47

View original version evidence (22 explicit versions)
typo3/cms-core Packagist
Affected rangeRecorded fix
From 8.0.0 before 8.7.25Ecosystem versions8.7.25
From 9.0.0 before 9.5.6Ecosystem versions9.5.6

Version evidence: OSV · GHSA-7733-hjv6-4h47

View original version evidence (33 explicit versions)
typo3/cms Packagist
Affected rangeRecorded fix
From 8.0.0 before 8.7.25Ecosystem versions8.7.25
From 9.0.0 before 9.5.6Ecosystem versions9.5.6

Version evidence: OSV · GHSA-7733-hjv6-4h47

View original version evidence (55 explicit versions)

Original source description

Meta

  • CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0)
  • CWE-79

:information_source:  This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020

Problem

It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.

{showFullName ? fullName : defaultValue}

Solution

Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described.

Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases:

  • TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.5)
  • TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1)

Credits

Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.

References

References