CVE-2011-4630: Typo3 XSS Vulnerability
Summary
CVE-2011-4630: Typo3 XSS Vulnerability. Affects typo3/cms across 3 version ranges.
< 4.3.12
>= 4.4.0, < 4.4.9
>= 4.5.0, < 4.5.4
Fixed in 4.3.12, 4.4.9 or 4.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building and managing websites. The vulnerability affects TYPO3 versions before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4. TYPO3 provides a browse_links wizard that allows users to browse and select links. However, due to insufficient input sanitization, remote attackers can exploit this feature to inject arbitrary web script or HTML, leading to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in TYPO3 allows remote attackers to inject arbitrary web script or HTML through the browse_links wizard. This can lead to the execution of malicious code in the context of the affected user's browser, potentially compromising their sensitive information or performing unauthorized actions on their behalf. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.3.124.3.12composer require typo3/cms:4.3.12 -
>= 4.4.0, < 4.4.94.4.9composer require typo3/cms:4.4.9 -
>= 4.5.0, < 4.5.44.5.4composer require typo3/cms:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading TYPO3 is not immediately feasible, a temporary workaround is to disable or restrict access to the browse_links wizard. This can be done by modifying the configuration or access permissions of the TYPO3 installation. However, this workaround may limit the functionality of the CMS, so upgrading to the patched version is strongly recommended.
Conclusion
The TYPO3 XSS vulnerability allows remote attackers to inject arbitrary web script or HTML, potentially leading to the execution of malicious code in the user's browser. It is crucial to upgrade TYPO3 to the patched versions and review user-generated content to mitigate the risk of XSS attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 is an open-source content management system (CMS) used for building and managing websites.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The vulnerability can be exploited by remote attackers through the browse_links wizard, which allows them to inject arbitrary web script or HTML.
The vulnerability can lead to the execution of malicious code in the context of the affected user's browser, potentially compromising their sensitive information or performing unauthorized actions on their behalf.
To mitigate the risk of XSS attacks, it is recommended to upgrade TYPO3 to the patched versions and review and sanitize any user-generated content.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
