Vulnerability advisory

GHSA-fv2m-9249-qx85

TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper

Published Sep 16, 2022Updated Dec 6, 2023OSV record ↗

Severity

Affected versions

Affected	Fixed in
`10.3.0` to before 10.4.32	`10.4.32`Advisories →
Also listed as affected (33) `v10.3.0` `v10.4.0` `v10.4.1` `v10.4.10` `v10.4.11` `v10.4.12` `v10.4.13` `v10.4.14` `v10.4.15` `v10.4.16` `v10.4.17` `v10.4.18` `v10.4.19` `v10.4.2` `v10.4.20` `v10.4.21` `v10.4.22` `v10.4.23` `v10.4.24` `v10.4.25` `v10.4.26` `v10.4.27` `v10.4.28` `v10.4.29` `v10.4.3` `v10.4.30` `v10.4.31` `v10.4.4` `v10.4.5` `v10.4.6` `v10.4.7` `v10.4.8` `v10.4.9`
`11.0.0` to before 11.5.16	`11.5.16`Advisories →
Also listed as affected (25) `v11.0.0` `v11.1.0` `v11.1.1` `v11.2.0` `v11.3.0` `v11.3.1` `v11.3.2` `v11.3.3` `v11.4.0` `v11.5.0` `v11.5.1` `v11.5.10` `v11.5.11` `v11.5.12` `v11.5.13` `v11.5.14` `v11.5.15` `v11.5.2` `v11.5.3` `v11.5.4` `v11.5.5` `v11.5.6` `v11.5.7` `v11.5.8` `v11.5.9`

Affected	Fixed in
`10.3.0` to before 10.4.32	`10.4.32`Advisories →
Also listed as affected (33) `v10.3.0` `v10.4.0` `v10.4.1` `v10.4.10` `v10.4.11` `v10.4.12` `v10.4.13` `v10.4.14` `v10.4.15` `v10.4.16` `v10.4.17` `v10.4.18` `v10.4.19` `v10.4.2` `v10.4.20` `v10.4.21` `v10.4.22` `v10.4.23` `v10.4.24` `v10.4.25` `v10.4.26` `v10.4.27` `v10.4.28` `v10.4.29` `v10.4.3` `v10.4.30` `v10.4.31` `v10.4.4` `v10.4.5` `v10.4.6` `v10.4.7` `v10.4.8` `v10.4.9`
`11.0.0` to before 11.5.16	`11.5.16`Advisories →
Also listed as affected (25) `v11.0.0` `v11.1.0` `v11.1.1` `v11.2.0` `v11.3.0` `v11.3.1` `v11.3.2` `v11.3.3` `v11.4.0` `v11.5.0` `v11.5.1` `v11.5.10` `v11.5.11` `v11.5.12` `v11.5.13` `v11.5.14` `v11.5.15` `v11.5.2` `v11.5.3` `v11.5.4` `v11.5.5` `v11.5.6` `v11.5.7` `v11.5.8` `v11.5.9`

Meta

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.1)

It has been discovered that the f:asset.css view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS.

Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem described above.

Thanks to TYPO3 contributor member Frank Nägler who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue.