Vulnerability advisory

CVE-2020-11064

Published May 13, 2020Updated Oct 24, 2026OSV record ↗

Also known as BIT-typo3-2020-11064GHSA-43gj-mj2w-wh46

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/TYPO3/typo3 ↗
41235ff8e38c6f3401df03ae8beddd62d662c525 to before 33a59bca3098ac08b262929fc9e4087dd44572cb	`33a59bca3098ac08b262929fc9e4087dd44572cb`
c91b70e450c52d29ffb08115fffbb7832b15a330 to before cf17e40087cd21faa6f9a12683631744d36f3f46	`cf17e40087cd21faa6f9a12683631744d36f3f46`
Also listed as affected (28) `v10.4.1` `v9.5.16` `v10.4.0` `v9.5.15` `v10.3.0` `v9.5.14` `v9.5.13` `v9.5.12` `v10.2.0` `v9.5.11` `v9.5.10` `v10.1.0` `v9.5.9` `v10.0.0` `v9.5.8` `v9.5.7` `v9.5.6` `v9.5.5` `v9.5.4` `v9.5.3` `v9.5.2` `v9.5.1` `v9.5.0` `v9.4.0` `v9.3.0` `v9.2.0` `v9.1.0` `v9.0.0`
GIT github.com/typo3/typo3 ↗
41235ff8e38c6f3401df03ae8beddd62d662c525 to before 33a59bca3098ac08b262929fc9e4087dd44572cb	`33a59bca3098ac08b262929fc9e4087dd44572cb`
c91b70e450c52d29ffb08115fffbb7832b15a330 to before cf17e40087cd21faa6f9a12683631744d36f3f46	`cf17e40087cd21faa6f9a12683631744d36f3f46`
Also listed as affected (28) `v10.4.1` `v9.5.16` `v10.4.0` `v9.5.15` `v10.3.0` `v9.5.14` `v9.5.13` `v9.5.12` `v10.2.0` `v9.5.11` `v9.5.10` `v10.1.0` `v9.5.9` `v10.0.0` `v9.5.8` `v9.5.7` `v9.5.6` `v9.5.5` `v9.5.4` `v9.5.3` `v9.5.2` `v9.5.1` `v9.5.0` `v9.4.0` `v9.3.0` `v9.2.0` `v9.1.0` `v9.0.0`

Description

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placeholder attributes containing data of other database records are vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.

References

Advisorygithub.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-43gj-mj2w-wh46 ↗