TYPO3 Backend Configuration XSS Vulnerability
Summary
CVE-2012-3529: Typo3 Backend Configuration XSS Vulnerability. Affects typo3/cms across 3 version ranges.
>= 4.5, < 4.5.19
>= 4.6, < 4.6.12
>= 4.7, < 4.7.4
Fixed in 4.5.19, 4.6.12 or 4.7.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications. The TYPO3 backend is the administrative interface of the CMS, where users can configure various settings and manage content. This vulnerability affects TYPO3 versions 4.5.x, 4.6.x, and 4.7.x.
Vulnerability Detail
The configuration module in the backend of TYPO3 versions 4.5.x before 4.5.19, 4.6.x before 4.6.12, and 4.7.x before 4.7.4 is susceptible to a cross-site scripting (XSS) attack. Remote authenticated backend users can exploit this vulnerability to obtain the encryption key through unspecified vectors. This can lead to unauthorized access to sensitive information and potential security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.5, < 4.5.194.5.19composer require typo3/cms:4.5.19 -
>= 4.6, < 4.6.124.6.12composer require typo3/cms:4.6.12 -
>= 4.7, < 4.7.44.7.4composer require typo3/cms:4.7.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading TYPO3 to the patched versions.
Conclusion
The TYPO3 Backend Configuration XSS Vulnerability is a security issue that affects TYPO3 versions 4.5.x, 4.6.x, and 4.7.x. It allows remote authenticated backend users to obtain the encryption key, potentially leading to unauthorized access and security breaches. To mitigate this vulnerability, it is crucial to upgrade TYPO3 to the patched versions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications.
The TYPO3 backend is the administrative interface of the CMS, where users can configure various settings and manage content.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access to sensitive information and potential security breaches.
Remote authenticated backend users can exploit this vulnerability to obtain the encryption key through unspecified vectors.
This vulnerability can lead to unauthorized access to sensitive information and potential security breaches.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
