Vulnerability advisory

CVE-2020-11065

Published May 13, 2020Updated Oct 24, 2026OSV record ↗

Also known as BIT-typo3-2020-11065GHSA-4j77-gg36-9864

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/TYPO3/typo3 ↗
efd84a5a507792083f9f4ec03f8c7d580adfc3d8 to before 33a59bca3098ac08b262929fc9e4087dd44572cb	`33a59bca3098ac08b262929fc9e4087dd44572cb`
22dd17fa8e2b2bb28e29e47ed8de1a23d6dd27b3 to before cf17e40087cd21faa6f9a12683631744d36f3f46	`cf17e40087cd21faa6f9a12683631744d36f3f46`
Also listed as affected (9) `v10.4.1` `v9.5.16` `v10.4.0` `v9.5.15` `v10.3.0` `v9.5.14` `v9.5.13` `v9.5.12` `v10.2.0`
GIT github.com/typo3/typo3 ↗
efd84a5a507792083f9f4ec03f8c7d580adfc3d8 to before 33a59bca3098ac08b262929fc9e4087dd44572cb	`33a59bca3098ac08b262929fc9e4087dd44572cb`
22dd17fa8e2b2bb28e29e47ed8de1a23d6dd27b3 to before cf17e40087cd21faa6f9a12683631744d36f3f46	`cf17e40087cd21faa6f9a12683631744d36f3f46`
Also listed as affected (9) `v10.4.1` `v9.5.16` `v10.4.0` `v9.5.15` `v10.3.0` `v9.5.14` `v9.5.13` `v9.5.12` `v10.2.0`

Description

In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.

References

Advisorygithub.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4j77-gg36-9864 ↗