Vulnerability advisory

GHSA-qmwf-j7g7-f5jw

Cross-Site Scripting in third party library mso/idna-convert

Published Jun 5, 2024Updated Dec 2, 2024OSV record ↗

Severity

Severity not reported.

Affected versions

typo3/cms Packagist

Affected	Fixed in
`7.6.0` to before 7.6.10	`7.6.10`Advisories →
Also listed as affected (10) `7.6.0` `7.6.1` `7.6.2` `7.6.3` `7.6.4` `7.6.5` `7.6.6` `7.6.7` `7.6.8` `7.6.9`
`8.0.0` to before 8.2.1	`8.2.1`Advisories →
Also listed as affected (6) `8.0.0` `8.0.1` `8.1.0` `8.1.1` `8.1.2` `8.2.0`

Description

Make sure to not expose the vendor directory to the publicly accessible document root. In composer managed installation, make sure to configure a dedicated web folder. In general it is recommended to not expose the complete typo3_src sources folder in the document root.

References

Webgithub.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2016-07-19-7.yaml ↗
Webtypo3.org/security/advisory/typo3-core-sa-2016-020 ↗