Vulnerability advisory

CVE-2023-47125

By-passing Cross-Site Scripting Protection in HTML Sanitizer

Published Nov 14, 2023Updated Oct 28, 2026OSV record ↗

Also known as BIT-typo3-2023-47125GHSA-mm79-jhqm-9j54

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/html-sanitizer ↗
ca1c30b9b5c160024257f456606b1f3f17138ca6 to before cead6b60be7122c9e6bdc40f702ca8b5980abca4	`cead6b60be7122c9e6bdc40f702ca8b5980abca4`
b32bbd462406f28d1fca4bde8a8cd8b49a4bdd39 to before b8f90717251d968c49dc77f8c1e5912e2fbe0dff	`b8f90717251d968c49dc77f8c1e5912e2fbe0dff`
GIT github.com/typo3/typo3 ↗
d7b1df9f4cd2fd34976bab4d4a5151f58feb671c to before 939ef26e7fcd18ec68af7743014446a45527e502	`939ef26e7fcd18ec68af7743014446a45527e502`
36096733dea4bd6f6168209609fa879dc25c0138 to before 639f2dbbafa5e6835499e70e111c7f22bc6cb966	`639f2dbbafa5e6835499e70e111c7f22bc6cb966`
Also listed as affected (36) `v2.1.3` `v1.5.2` `v1.5.1` `v2.1.2` `v1.5.0` `v2.1.1` `v2.1.0` `v2.0.16` `v2.0.15` `v2.0.14` `v2.0.13` `v2.0.12` `v2.0.11` `v2.0.10` `v2.0.9` `v2.0.8` `v2.0.7` `v2.0.6` `v2.0.5` `v2.0.4` `v2.0.3` `v2.0.2` `v2.0.1` `v2.0.0` `v12.4.7` `v12.4.6` `v12.4.5` `v12.4.4` `v12.4.3` `v12.4.2` `v12.4.1` `v12.4.0` `v12.3.0` `v12.2.0` `v12.1.0` `v12.0.0`

Description

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2023-47125

Affected versions

Repository

Description

References