GHSA-6xwf-7rfm-4gwc
GHSA-6xwf-7rfm-4gwc · TYPO3 Cross-Site Scripting in Filelist Module
This page contains facts from public vulnerability sources. Check the original advisory before updating.
It has been discovered that the output table listing in the “Files” backend module is vulnerable to cross-site scripting when a file extension contains malicious sequences. Access to the file system of the server - either directly or through synchronization - is required to exploit the vulnerability.
CVSS 6.1 · Medium · Fix available
- Published
- Updated
Stack: php
Affected products and versions
typo3/cms-core Packagist
- Versions
- v10.0.0
- v10.1.0
- v10.2.0
- Affected ranges
- ECOSYSTEM: ≥ 10.0.0, < 10.2.1
Update to 10.2.1
typo3/cms-core Packagist
- Versions
- v8.7.10
- v8.7.11
- v8.7.12
- v8.7.13
- v8.7.14
- v8.7.15
- v8.7.16
- v8.7.17
- v8.7.18
- v8.7.19
- v8.7.20
- v8.7.21
- v8.7.22
- v8.7.23
- v8.7.24
- v8.7.25
- v8.7.26
- v8.7.27
- v8.7.28
- v8.7.29
- v8.7.7
- v8.7.8
- v8.7.9
- Affected ranges
- ECOSYSTEM: ≥ 8.0.0, < 8.7.30
Update to 8.7.30
typo3/cms-core Packagist
- Versions
- v9.0.0
- v9.1.0
- v9.2.0
- v9.2.1
- v9.3.0
- v9.3.1
- v9.3.2
- v9.3.3
- v9.4.0
- v9.5.0
- v9.5.1
- v9.5.10
- v9.5.11
- v9.5.2
- v9.5.3
- v9.5.4
- v9.5.5
- v9.5.6
- v9.5.7
- v9.5.8
- v9.5.9
- Affected ranges
- ECOSYSTEM: ≥ 9.0.0, < 9.5.12
Update to 9.5.12