GHSA-v4qr-8h2v-qpjx
GHSA-v4qr-8h2v-qpjx · Cross-Site Scripting in TYPO3 CMS Backend
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Failing to properly encode user input, backend forms are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability.
CVSS 5.4 · Medium · Fix available
- Published
- Updated
Stack: php
Affected products and versions
typo3/cms Packagist
- Versions
- 8.0.0
- 8.0.1
- 8.1.0
- 8.1.1
- 8.1.2
- 8.2.0
- 8.2.1
- 8.3.0
- 8.3.1
- 8.4.0
- 8.4.1
- 8.5.0
- 8.5.1
- 8.6.0
- 8.6.1
- 8.7.0
- 8.7.1
- 8.7.2
- v8.7.3
- v8.7.4
- Affected ranges
- ECOSYSTEM: ≥ 8.0.0, < 8.7.5
Update to 8.7.5
Original sources
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2017-09-05-1.yaml
- https://github.com/TYPO3/typo3
- https://typo3.org/security/advisory/typo3-core-sa-2017-004
- https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-004
- https://osv.dev/vulnerability/GHSA-v4qr-8h2v-qpjx