Vulnerability advisory

GHSA-7733-hjv6-4h47

Cross-Site Scripting in ternary conditional operator

Published Oct 8, 2020Updated Sep 10, 2026OSV record ↗

Also known as BIT-typo3-2020-15241CVE-2020-15241

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

typo3fluid/fluid Packagist

All typo3fluid/fluid advisories →

Affected	Fixed in
`2.0.0` to before 2.0.5	`2.0.5`Advisories →
Also listed as affected (5) `2.0.0` `2.0.1` `2.0.2` `2.0.3` `2.0.4`
`2.1.0` to before 2.1.4	`2.1.4`Advisories →
Also listed as affected (4) `2.1.0` `2.1.1` `2.1.2` `2.1.3`
`2.2.0` to before 2.2.1	`2.2.1`Advisories →
Also listed as affected (1) `2.2.0`
`2.3.0` to before 2.3.5	`2.3.5`Advisories →
Also listed as affected (5) `2.3.0` `2.3.1` `2.3.2` `2.3.3` `2.3.4`
`2.4.0` to before 2.4.1	`2.4.1`Advisories →
Also listed as affected (1) `2.4.0`
`2.5.0` to before 2.5.5	`2.5.5`Advisories →
Also listed as affected (5) `2.5.0` `2.5.1` `2.5.2` `2.5.3` `2.5.4`
`2.6.0` to before 2.6.1	`2.6.1`Advisories →
Also listed as affected (1) `2.6.0`

typo3/cms-core Packagist

All typo3/cms-core advisories →

Affected	Fixed in
`8.0.0` to before 8.7.25	`8.7.25`Advisories →
Also listed as affected (18) `v8.7.10` `v8.7.11` `v8.7.12` `v8.7.13` `v8.7.14` `v8.7.15` `v8.7.16` `v8.7.17` `v8.7.18` `v8.7.19` `v8.7.20` `v8.7.21` `v8.7.22` `v8.7.23` `v8.7.24` `v8.7.7` `v8.7.8` `v8.7.9`
`9.0.0` to before 9.5.6	`9.5.6`Advisories →
Also listed as affected (15) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.2` `v9.5.3` `v9.5.4` `v9.5.5`

typo3/cms Packagist

All typo3/cms advisories →

Affected	Fixed in
`8.0.0` to before 8.7.25	`8.7.25`Advisories →
Also listed as affected (40) `8.0.0` `8.0.1` `8.1.0` `8.1.1` `8.1.2` `8.2.0` `8.2.1` `8.3.0` `8.3.1` `8.4.0` `8.4.1` `8.5.0` `8.5.1` `8.6.0` `8.6.1` `8.7.0` `8.7.1` `8.7.2` `v8.7.10` `v8.7.11` `v8.7.12` `v8.7.13` `v8.7.14` `v8.7.15` `v8.7.16` `v8.7.17` `v8.7.18` `v8.7.19` `v8.7.20` `v8.7.21` `v8.7.22` `v8.7.23` `v8.7.24` `v8.7.3` `v8.7.4` `v8.7.5` `v8.7.6` `v8.7.7` `v8.7.8` `v8.7.9`
`9.0.0` to before 9.5.6	`9.5.6`Advisories →
Also listed as affected (15) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.2` `v9.5.3` `v9.5.4` `v9.5.5`

Description

Meta

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0)

CWE-79

:information_source: This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020

Problem

It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.

{showFullName ? fullName : defaultValue}

Solution

Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described.

Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases:

TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.5)
TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1)

Credits

Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.

References

TYPO3-CORE-SA-2019-013