TYPO3 API XSS Vulnerability in typo3/cms
Summary
CVE-2012-3530: Typo3 API XSS Vulnerability. Affects typo3/cms across 3 version ranges.
>= 4.5, < 4.5.19
>= 4.6, < 4.6.12
>= 4.7, < 4.7.4
Fixed in 4.5.19, 4.6.12 or 4.7.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a range of features and functionalities for website development, including templating, content editing, and extension management. However, TYPO3 CMS versions 4.5.x before 4.5.19, 4.6.x before 4.6.12, and 4.7.x before 4.7.4 are vulnerable to a cross-site scripting (XSS) attack due to an incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function.
Vulnerability Detail
The vulnerability arises from the incomplete blacklist in the t3lib_div::quoteJSvalue API function. This allows remote attackers to conduct XSS attacks by exploiting certain HTML5 JavaScript events. An attacker could inject malicious code into a website, potentially leading to the execution of arbitrary scripts in the context of the victim's browser. This could result in various security risks, such as session hijacking, data theft, or defacement of the affected website.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.5, < 4.5.194.5.19composer require typo3/cms:4.5.19 -
>= 4.6, < 4.6.124.6.12composer require typo3/cms:4.6.12 -
>= 4.7, < 4.7.44.7.4composer require typo3/cms:4.7.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate update is not possible, a temporary workaround can be implemented by manually applying the necessary security patches provided by TYPO3. These patches address the incomplete blacklist vulnerability and mitigate the risk of XSS attacks. It is important to note that this workaround is not a permanent solution and updating to the latest secure version is still recommended.
Conclusion
The TYPO3 API XSS vulnerability in typo3/cms exposes websites to cross-site scripting attacks, which can have severe consequences such as session hijacking, data theft, or defacement. It is crucial to update TYPO3 CMS to the latest secure version (4.5.19, 4.6.12, or 4.7.4) to mitigate this vulnerability. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 CMS is an open-source content management system used for website development and management.
TYPO3 CMS versions 4.5.x before 4.5.19, 4.6.x before 4.6.12, and 4.7.x before 4.7.4 are affected.
This vulnerability allows remote attackers to conduct cross-site scripting (XSS) attacks, potentially leading to session hijacking, data theft, or website defacement.
To fix this vulnerability, update TYPO3 CMS to version 4.5.19, 4.6.12, or 4.7.4, depending on the installed version.
Yes, a temporary workaround is available by manually applying the provided security patches. However, updating to the latest secure version is still recommended.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
