Vulnerability advisory

GHSA-jr79-65xr-q7cx

TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms

Published May 17, 2022Updated Feb 7, 2024OSV record ↗

Also known as CVE-2010-3659

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

typo3/cms-backend Packagist

All typo3/cms-backend advisories →

Affected	Fixed in
`4.1.0` to before 4.1.14	`4.1.14`Advisories →
`4.2.0` to before 4.2.13	`4.2.13`Advisories →
`4.3.0` to before 4.3.4	`4.3.4`Advisories →
`4.4.0` to before 4.4.1	`4.4.1`Advisories →

Description

Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified parameters to unknown backend forms.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2010-3659 ↗
Packagegithub.com/TYPO3-CMS/backend ↗
Websecurity-tracker.debian.org/tracker/CVE-2010-3659 ↗
Webtypo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-012 ↗
Webweb.archive.org/web/20120903133822/http://www.securityfocus.com/bid/42029 ↗
Webwww.openwall.com/lists/oss-security/2010/09/28/8 ↗
Webwww.openwall.com/lists/oss-security/2014/02/12/8 ↗