CVE-2012-5888: Basic SEO Features (seo_basics) Extension TYPO3 Cross-site Scripting Vulnerability
Summary
CVE-2012-5888: Basic SEO Features (seo_basics) extension TYPO3 vulnerable to Cross-site Scripting. Affects b13/seo_basics versions < 0.8.2. Fixed in 0.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Basic SEO Features (seo_basics) extension for TYPO3 is designed to enhance the search engine optimization capabilities of TYPO3 websites. It provides essential tools for managing SEO metadata, improving site visibility, and optimizing content for search engines. However, prior to version 0.8.2, this extension is vulnerable to a Cross-site Scripting (XSS) attack, which can compromise the security of websites using this extension.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability in the Basic SEO Features (seo_basics) extension allows remote attackers to inject arbitrary web scripts or HTML into the application through unspecified vectors. This can lead to unauthorized actions being performed on behalf of users, data theft, or the distribution of malicious content. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
0.8.2
This is the first release that contains the fix.
composer require b13/seo_basics:0.8.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the Basic SEO Features extension temporarily until the update can be applied. This will prevent the exploitation of the vulnerability while maintaining the security of your TYPO3 installation.
Conclusion
The Basic SEO Features (seo_basics) extension for TYPO3 has a critical XSS vulnerability that can be exploited by attackers. It is essential to update to version 0.8.2 or later to protect your site from potential threats. Regular monitoring and prompt updates are crucial for maintaining the security of your web applications.
See every vulnerability recorded for b13/seo_basics →
FAQ
Cross-site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to data theft or unauthorized actions.
If you are using a version of the Basic SEO Features (seo_basics) extension prior to 0.8.2, your site is vulnerable. You can check your installed packages using Composer or by reviewing your TYPO3 extension manager.
Failing to address this vulnerability can expose your site to XSS attacks, which may result in data breaches, loss of user trust, and potential legal repercussions.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using the composer.lock file. You can also check if your application is affected by this vulnerability using the Vulert playground.
If you cannot update the extension right away, consider disabling it temporarily to prevent exploitation until you can apply the necessary updates.
