TYPO3 Backend Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2010-3660: TYPO3 is vulnerable to Cross-Site Scripting (XSS) on the backend. Affects typo3/cms-backend across 4 version ranges.
< 4.1.14
>= 4.2.0, < 4.2.13
>= 4.3.0, < 4.3.4
>= 4.4.0, < 4.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) used for building and managing websites. The TYPO3 CMS backend is a web-based interface that allows administrators to control and configure the CMS. This vulnerability affects TYPO3 versions before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1. The vulnerability allows for Cross-Site Scripting (XSS) attacks to occur on the TYPO3 backend.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in TYPO3 backend allows an attacker to inject malicious scripts into the backend interface. This can lead to the execution of arbitrary code in the context of the affected user's session. An attacker can exploit this vulnerability by tricking an authenticated backend user into clicking on a specially crafted link or visiting a malicious website. The impact of this vulnerability includes potential data theft, session hijacking, and unauthorized actions performed by the attacker.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.144.1.14composer require typo3/cms-backend:4.1.14 -
>= 4.2.0, < 4.2.134.2.13composer require typo3/cms-backend:4.2.13 -
>= 4.3.0, < 4.3.44.3.4composer require typo3/cms-backend:4.3.4 -
>= 4.4.0, < 4.4.14.4.1composer require typo3/cms-backend:4.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the latest version of TYPO3 to mitigate the risk.
Conclusion
The TYPO3 backend is vulnerable to Cross-Site Scripting (XSS) attacks. It is crucial for TYPO3 users to upgrade to the latest patched version or apply the official patches to mitigate the risk. Keeping TYPO3 installations up to date with the latest security patches is essential for maintaining the security of the CMS. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-backend →
FAQ
TYPO3 is an open-source content management system (CMS) used for building and managing websites.
The TYPO3 backend is a web-based interface that allows administrators to control and configure the TYPO3 CMS.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
An attacker can exploit this vulnerability by tricking an authenticated backend user into clicking on a specially crafted link or visiting a malicious website.
The potential impacts of this vulnerability include data theft, session hijacking, and unauthorized actions performed by the attacker.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
