{"id":"GHSA-qmmw-ch2q-j6xx","aliases":["CVE-2012-6147"],"title":"Typo3 Backend API XSS Vulnerability","description":"Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.","severity":"low","score":null,"published":"2022-05-17T01:37:41.000Z","modified":"2024-01-12T18:13:41.746Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"typo3/cms","ranges":[{"events":[{"introduced":"4.5.0"},{"fixed":"4.5.21"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.5.21"]},{"ecosystem":"Packagist","name":"typo3/cms","ranges":[{"events":[{"introduced":"4.6.0"},{"fixed":"4.6.14"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.6.14"]},{"ecosystem":"Packagist","name":"typo3/cms","ranges":[{"events":[{"introduced":"4.7.0"},{"fixed":"4.7.6"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.7.6"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2012-6147","https://exchange.xforce.ibmcloud.com/vulnerabilities/79967","https://github.com/TYPO3/typo3","http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005","http://www.openwall.com/lists/oss-security/2013/06/19/4"],"sources":[{"name":"OSV","id":"GHSA-qmmw-ch2q-j6xx","modified":"2024-01-12T18:13:41.746922Z","url":"https://osv.dev/vulnerability/GHSA-qmmw-ch2q-j6xx"}],"assessments":[]}