CVE-2012-3531: Typo3 Install Tool XSS Vulnerability
Summary
CVE-2012-3531: Typo3 Install Tool XSS Vulnerability. Affects typo3/cms across 3 version ranges.
>= 4.5, < 4.5.19
>= 4.6, < 4.6.12
>= 4.7, < 4.7.4
Fixed in 4.5.19, 4.6.12 or 4.7.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for creating and managing websites. The Install Tool is a component of TYPO3 that provides a web-based interface for configuring and installing the CMS. It allows administrators to perform various tasks such as setting up the database, configuring extensions, and managing user accounts. However, a cross-site scripting (XSS) vulnerability has been discovered in the Install Tool of TYPO3 versions 4.5.x, 4.6.x, and 4.7.x.
Vulnerability Detail
The XSS vulnerability in the TYPO3 Install Tool allows remote attackers to inject arbitrary web script or HTML into the application. The specific vectors of the attack are unspecified. This vulnerability can be exploited by an attacker to execute malicious code in the context of the affected TYPO3 installation. The impact of this vulnerability can range from defacement of the website to stealing sensitive user information or performing actions on behalf of the user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.5, < 4.5.194.5.19composer require typo3/cms:4.5.19 -
>= 4.6, < 4.6.124.6.12composer require typo3/cms:4.6.12 -
>= 4.7, < 4.7.44.7.4composer require typo3/cms:4.7.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by upgrading TYPO3 to the patched versions.
Conclusion
The XSS vulnerability in the TYPO3 Install Tool can have serious consequences for the security and integrity of TYPO3 installations. It is crucial to apply the recommended fix by upgrading to the patched versions to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 is an open-source content management system (CMS) used for creating and managing websites.
The Install Tool is a web-based interface in TYPO3 used for configuring and installing the CMS.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
An attacker can exploit the XSS vulnerability to execute arbitrary code, deface the website, steal user information, or perform actions on behalf of the user.
To protect your TYPO3 installation, it is recommended to upgrade to the patched versions mentioned in the 'How to Fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
