GHSA-gvxv-p9rv-gmcgmedium6.1
brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting
Impact
The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
brotkrueml/typo3-matomo-integration Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 1.3.2Ecosystem versions | 1.3.2 |
Version evidence: OSV · GHSA-gvxv-p9rv-gmcg
View original version evidence (6 explicit versions)
Original source description
The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2022-33156
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/brotkrueml/typo3-matomo-integration/CVE-2022-33156.yaml
- Source reference github.com/brotkrueml/typo3-matomo-integration
- Security advisory typo3.org/security/advisory/typo3-ext-sa-2022-011