CVE-2012-6147: Typo3 Backend API XSS Vulnerability
Summary
CVE-2012-6147: Typo3 Backend API XSS Vulnerability. Affects typo3/cms across 3 version ranges.
>= 4.5.0, < 4.5.21
>= 4.6.0, < 4.6.14
>= 4.7.0, < 4.7.6
Fixed in 4.5.21, 4.6.14 or 4.7.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It provides a flexible and extensible platform for building websites and web applications. The TYPO3 Backend API is a component that allows authenticated backend users to manage and control the CMS. It includes features such as tree rendering and form handling. However, a vulnerability has been discovered in the tree render API (TCA-Tree) of TYPO3 versions 4.5.x, 4.6.x, and 4.7.x. This vulnerability exposes remote authenticated backend users to cross-site scripting (XSS) attacks, enabling them to inject arbitrary web script or HTML into the application.
Vulnerability Detail
The TYPO3 Backend API in versions 4.5.x, 4.6.x, and 4.7.x is susceptible to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote authenticated backend users to inject malicious web script or HTML into the application. The exact vectors of exploitation have not been disclosed. However, it is important to note that this vulnerability requires authentication as a backend user. The impact of successful exploitation can range from defacement of the website to the theft of sensitive user information. The vulnerability has been assigned the CVE identifier CVE-2012-6147.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.5.0, < 4.5.214.5.21composer require typo3/cms:4.5.21 -
>= 4.6.0, < 4.6.144.6.14composer require typo3/cms:4.6.14 -
>= 4.7.0, < 4.7.64.7.6composer require typo3/cms:4.7.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, as a general best practice, it is recommended to implement input validation and output encoding to prevent XSS attacks. Developers should sanitize user input and encode output to ensure that any potentially malicious scripts or HTML tags are rendered harmless.
Conclusion
The TYPO3 Backend API in versions 4.5.x, 4.6.x, and 4.7.x is vulnerable to cross-site scripting (XSS) attacks. To mitigate this vulnerability, it is crucial to upgrade TYPO3 to the latest patched versions (4.5.21, 4.6.14, or 4.7.6). Additionally, developers should implement input validation and output encoding to prevent XSS attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 is an open-source content management system (CMS) written in PHP. It provides a flexible and extensible platform for building websites and web applications.
The TYPO3 Backend API is a component of TYPO3 that allows authenticated backend users to manage and control the CMS. It includes features such as tree rendering and form handling.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or HTML into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or performing actions on behalf of the user.
To mitigate the XSS vulnerability in TYPO3, it is recommended to upgrade to the latest version (4.5.21, 4.6.14, or 4.7.6) that includes the necessary patches. Additionally, implementing input validation and output encoding can help prevent XSS attacks.
Yes, this vulnerability requires authentication as a backend user in TYPO3. Remote unauthenticated attackers cannot exploit this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
