Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/TYPO3/typo3 ↗ | |
| 41235ff8e38c6f3401df03ae8beddd62d662c525 through 860158afc7f8aceb8eb39495e37c80a6252ed1eb | No fix listed |
| c91b70e450c52d29ffb08115fffbb7832b15a330 through fe16eeb92d49edc5e79041dd949bc68cf66dfdce | No fix listed |
| 6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 through 5f11a2c94ea85f0401b0e00ec962368aa312ea1f | No fix listed |
Also listed as affected (60)
| |
| GIT github.com/typo3/typo3 ↗ | |
| 41235ff8e38c6f3401df03ae8beddd62d662c525 through 860158afc7f8aceb8eb39495e37c80a6252ed1eb | No fix listed |
| c91b70e450c52d29ffb08115fffbb7832b15a330 through fe16eeb92d49edc5e79041dd949bc68cf66dfdce | No fix listed |
| 6a5e2d4097ef0a0e3ea955af93cf83810d6fa234 through 5f11a2c94ea85f0401b0e00ec962368aa312ea1f | No fix listed |
Also listed as affected (60)
| |
Description
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components QueryGenerator and QueryView are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.