GHSA-f3rf-v9qm-9c89 — Cross-site Scripting in the femanager TYPO3 extension

The advisory, in context

The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website.

Note: If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) to prevent upload of malicious SVG files or to set up a strict Content Security Policy for the destination folder of uploaded images.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

in2code/femanager Packagist

Ecosystem versions

Earlier releases before 5.5.1

Fixed in 5.5.1

36 explicitly affected versions

2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.2.0, 3.3.0, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 5.0.0, 5.1.0, 5.1.1, 5.2.0, 5.3.0, 5.3.1, 5.4.0, 5.4.1, 5.4.2, 5.5.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "5.5.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.5.0",
    "2.5.1",
    "2.6.0",
    "2.6.1",
    "2.6.2",
    "2.7.0",
    "3.0.0",
    "3.0.1",
    "3.0.2",
    "3.1.0",
    "3.1.1",
    "3.1.2",
    "3.1.3",
    "3.2.0",
    "3.3.0",
    "4.0.0",
    "4.0.1",
    "4.0.2",
    "4.1.0",
    "4.1.1",
    "4.2.0",
    "4.2.1",
    "4.2.2",
    "4.2.3",
    "4.2.4",
    "4.2.5",
    "5.0.0",
    "5.1.0",
    "5.1.1",
    "5.2.0",
    "5.3.0",
    "5.3.1",
    "5.4.0",
    "5.4.1",
    "5.4.2",
    "5.5.0"
  ]
}

in2code/femanager Packagist

Ecosystem versions

From 6.0.0 before 6.3.1

Fixed in 6.3.1

8 explicitly affected versions

6.0.0, 6.0.1, 6.1.0, 6.1.1, 6.1.2, 6.2.0, 6.2.1, 6.3.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.0.0"
        },
        {
          "fixed": "6.3.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.0.0",
    "6.0.1",
    "6.1.0",
    "6.1.1",
    "6.1.2",
    "6.2.0",
    "6.2.1",
    "6.3.0"
  ]
}

Set up in your agent.

Investigate in your agent.

Cross-site Scripting in the femanager TYPO3 extension

The advisory, in context

Affected packages

References