Vulnerability advisory

GHSA-56f9-5563-m2h7

Typo3 XSS Vulnerability

Published May 17, 2022Updated Feb 20, 2024OSV record ↗

Also known as CVE-2015-8755

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

typo3/cms Packagist

All typo3/cms advisories →

Affected	Fixed in
`6.2` to before 6.2.16	`6.2.16`Advisories →
Also listed as affected (17) `6.2.0` `6.2.1` `6.2.10` `6.2.10-rc1` `6.2.11` `6.2.12` `6.2.13` `6.2.14` `6.2.15` `6.2.2` `6.2.3` `6.2.4` `6.2.5` `6.2.6` `6.2.7` `6.2.8` `6.2.9`
`7.0` to before 7.6.1	`7.6.1`Advisories →
Also listed as affected (10) `7.0.0` `7.0.1` `7.0.2` `7.1.0` `7.2.0` `7.3.0` `7.3.1` `7.4.0` `7.5.0` `7.6.0`

Description

Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2015-8755 ↗
Webweb.archive.org/web/20160621193435/http://www.securityfocus.com/bid/79236 ↗
Webweb.archive.org/web/20161012163838/http://www.securitytracker.com/id/1034483 ↗
Webtypo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011 ↗