CVE-2012-6145: Typo3 Backend History Module Vulnerable to XSS
Summary
CVE-2012-6145: Typo3 Backend History Module Vulnerable to XSS. Affects typo3/cms across 3 version ranges.
>= 4.5.0, < 4.5.21
>= 4.6.0, < 4.6.14
>= 4.7.0, < 4.7.6
Fixed in 4.5.21, 4.6.14 or 4.7.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It provides a flexible and extensible platform for building websites and web applications. The Backend History module in TYPO3 versions 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML through unspecified vectors.
Vulnerability Detail
The TYPO3 Backend History module is vulnerable to a cross-site scripting (XSS) attack. This vulnerability allows remote authenticated backend users to inject malicious web script or HTML into the application. The specific vectors through which the attack can be carried out are not disclosed. An attacker could exploit this vulnerability to perform various malicious activities, such as stealing sensitive user information, performing unauthorized actions on behalf of the user, or defacing the website.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.5.0, < 4.5.214.5.21composer require typo3/cms:4.5.21 -
>= 4.6.0, < 4.6.144.6.14composer require typo3/cms:4.6.14 -
>= 4.7.0, < 4.7.64.7.6composer require typo3/cms:4.7.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade TYPO3 to the fixed versions.
Conclusion
The TYPO3 Backend History module is vulnerable to a cross-site scripting (XSS) attack. To ensure the security of the TYPO3 installation, it is recommended to upgrade to the fixed versions mentioned. Regularly updating the TYPO3 installation with the latest security patches is crucial to protect against known vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 is an open-source content management system (CMS) written in PHP. It provides a flexible and extensible platform for building websites and web applications.
The Backend History module in TYPO3 is a feature that allows backend users to view the history of actions performed in the TYPO3 backend. It provides a log of changes made to pages, content, and other elements within the CMS.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information, performing unauthorized actions, or defacing websites.
An attacker with authenticated backend access can exploit this vulnerability by injecting malicious web script or HTML through unspecified vectors in the Backend History module. This can be done by crafting specially crafted input that is not properly sanitized or validated by the application.
Yes, the vulnerability can be fixed by upgrading TYPO3 to version 4.5.21, 4.6.14, or 4.7.6, depending on the installed version. These versions include the necessary patches to mitigate the XSS vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
