Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/TYPO3/typo3 ↗ | |
| 3ca26fbd711b62db4cc6df5ff7b98d4a99b14670 through 77f092b4b9a9690fbd033ee8e2e9112f3ea7e08f | No fix listed |
Also listed as affected (2)
| |
| GIT github.com/typo3/fluid ↗ | |
| All commits before 745a99973f5c88e110377dd484745e92e430293c | 745a99973f5c88e110377dd484745e92e430293c |
| 617595f736ca1e880817cea852572b9b0b329f39 to before abdcefa62a618e02dbd429b910f951f4101b5d44 | abdcefa62a618e02dbd429b910f951f4101b5d44 |
| 48e434663ec3844bd8f8f91f8fa33587b1a643e2 to before 75e5675e30b6dae17814aadd746a6b6145b095ef | 75e5675e30b6dae17814aadd746a6b6145b095ef |
| b36c00a756cea9df944be0ef2e4827554646832a to before 1e461d22b496f466c158c8be9a2821e6dc8dfc86 | 1e461d22b496f466c158c8be9a2821e6dc8dfc86 |
| f583badd3b2a90f046fe5c1e0459300325a3e0ce to before 27d81c7ec1e70609a5f937ba73dc62dd9708afe1 | 27d81c7ec1e70609a5f937ba73dc62dd9708afe1 |
| 5dc5836bf1bb3465cb0cc69f6471c5519d33b934 to before e4ca051ad105a6bce02b2809172fb26d45fd06a3 | e4ca051ad105a6bce02b2809172fb26d45fd06a3 |
| e3533d0b80e4020cf0de7a546efaae25866f898b to before 9ef6a8ffff2e812025fc0701b4ce72eea6911a3d | 9ef6a8ffff2e812025fc0701b4ce72eea6911a3d |
Also listed as affected (32)
| |
| GIT github.com/typo3/typo3 ↗ | |
| 3ca26fbd711b62db4cc6df5ff7b98d4a99b14670 through 77f092b4b9a9690fbd033ee8e2e9112f3ea7e08f | No fix listed |
Also listed as affected (2)
| |
Description
TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1).