CVE-2010-5100: TYPO3 CMS-Install Tool Cross-Site Scripting Vulnerability
Summary
CVE-2010-5100: TYPO3 Cross-Site Scripting vulnerability in the Install Tool. Affects typo3/cms-install across 3 version ranges.
>= 4.2.0, < 4.2.16
>= 4.3.0, < 4.3.9
>= 4.4.0, < 4.4.5
Fixed in 4.2.16, 4.3.9 or 4.4.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS-Install Tool is a component of the TYPO3 content management system that allows users to install and configure TYPO3 on a web server. It provides a web-based interface for managing the installation process and performing various administrative tasks. The tool is written in PHP and is a critical part of the TYPO3 CMS ecosystem.
Vulnerability Detail
The TYPO3 CMS-Install Tool is affected by multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML into the tool via unspecified vectors. An attacker could exploit these vulnerabilities to execute malicious code in the context of the affected user's browser, potentially leading to session hijacking, data theft, or other forms of web application compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.164.2.16composer require typo3/cms-install:4.2.16 -
>= 4.3.0, < 4.3.94.3.9composer require typo3/cms-install:4.3.9 -
>= 4.4.0, < 4.4.54.4.5composer require typo3/cms-install:4.4.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the security patches as soon as possible to mitigate the risk of exploitation.
Conclusion
The TYPO3 CMS-Install Tool is affected by multiple cross-site scripting vulnerabilities that can be exploited by remote authenticated users. To mitigate the risk of exploitation, it is recommended to upgrade to the latest version of TYPO3 CMS-Install Tool (4.2.16, 4.3.9, or 4.4.5) and apply the necessary security patches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-install →
FAQ
These vulnerabilities allow remote authenticated users to execute arbitrary code in the context of the affected user's browser. This could lead to session hijacking, data theft, or other forms of web application compromise.
There are no known instances of these vulnerabilities being exploited in the wild. However, it is important to apply the security patches to prevent potential exploitation.
No, these vulnerabilities can only be exploited by remote authenticated users.
While these vulnerabilities could potentially lead to data theft or unauthorized access, there is no inherent risk of data loss or corruption.
Yes, you can use the Vulert Playground (https://vulert.com/scanner) to check if your TYPO3 installation is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze your dependencies and alert you if any vulnerabilities are found.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-install.
