Vulnerability advisory
GHSA-qmmw-ch2q-j6xx
Typo3 Backend API XSS Vulnerability
Also known as CVE-2012-6147
Severity
Severity not reported.
Affected versions
typo3/cms Packagist
All typo3/cms advisories →| Affected | Fixed in |
|---|---|
4.5.0 to before 4.5.21 | 4.5.21Advisories → |
4.6.0 to before 4.6.14 | 4.6.14Advisories → |
4.7.0 to before 4.7.6 | 4.7.6Advisories → |
Description
Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.