TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors
Impact
It has been discovered that link tags generated by typolink functionality in the website's frontend are vulnerable to cross-site scripting - values being assigned to HTML attributes have not been parsed correctly. A valid backend user account is needed to exploit this vulnerability.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 6.2.0 before 6.2.14Ecosystem versions | 6.2.14 |
| From 7.0.0 before 7.3.1Ecosystem versions | 7.3.1 |
Version evidence: OSV · GHSA-wp8j-c736-c5r3
View original version evidence (21 explicit versions)
Original source description
It has been discovered that link tags generated by typolink functionality in the website's frontend are vulnerable to cross-site scripting - values being assigned to HTML attributes have not been parsed correctly. A valid backend user account is needed to exploit this vulnerability.
As second and separate vulnerability in the filelist module of the backend user interface has been referenced with this advisory as well. Error messages being shown after using a malicious name for renaming a file are not propery encoded, thus vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability.
References
- Patch github.com/TYPO3/typo3/commit/7695d91fca1a96a3a3e7466097ae92c32b1130d8
- Patch github.com/TYPO3/typo3/commit/d7feb40c8d277c6b6ab3a548313be1e1a2084299
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2015-07-01-3.yaml
- Source reference github.com/TYPO3/typo3
- Security advisory typo3.org/security/advisory/typo3-core-sa-2015-004
- Security advisory typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-004