Typo3 Backend XSS Vulnerability in typo3/cms
Summary
CVE-2012-3528: Typo3 Backend XSS Vulnerability. Affects typo3/cms across 3 version ranges.
>= 4.5, < 4.5.19
>= 4.6, < 4.6.12
>= 4.7, < 4.7.4
Fixed in 4.5.19, 4.6.12 or 4.7.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a backend interface for administrators to perform various tasks such as content editing, user management, and system configuration. However, versions 4.5.x before 4.5.19, 4.6.x before 4.6.12, and 4.7.x before 4.7.4 of TYPO3 CMS are vulnerable to multiple cross-site scripting (XSS) attacks in the backend. These vulnerabilities can be exploited by authenticated backend users to inject arbitrary web scripts or HTML into the system.
Vulnerability Detail
The XSS vulnerabilities in TYPO3 CMS backend allow remote authenticated users to inject malicious scripts or HTML code into the system. This can lead to various security risks, including session hijacking, defacement of the website, stealing sensitive information, and performing unauthorized actions on behalf of the user. The exact vectors of exploitation are unspecified in the advisory.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.5, < 4.5.194.5.19composer require typo3/cms:4.5.19 -
>= 4.6, < 4.6.124.6.12composer require typo3/cms:4.6.12 -
>= 4.7, < 4.7.44.7.4composer require typo3/cms:4.7.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workaround is mentioned in the advisory. The recommended solution is to upgrade to the fixed versions of TYPO3 CMS.
Conclusion
The TYPO3 Backend XSS Vulnerability in typo3/cms can allow authenticated backend users to inject malicious scripts or HTML into the system, leading to potential security risks. It is recommended to upgrade to the fixed versions of TYPO3 CMS (4.5.19, 4.6.12, or 4.7.4) to mitigate these vulnerabilities. For further assistance and support in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 CMS is an open-source content management system used for creating and managing websites.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Users of TYPO3 CMS versions 4.5.x, 4.6.x, and 4.7.x are affected by this vulnerability.
An attacker can exploit an XSS vulnerability to perform various malicious actions, such as stealing user information, hijacking sessions, or defacing websites.
To protect your TYPO3 CMS installation, it is crucial to keep the software up to date by applying the latest security patches and updates.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
