CVE-2013-5323: Static Info Tables Package Vulnerable to Cross-site Scripting
Summary
CVE-2013-5323: Static Info Tables (static_info_tables) extension TYPO3 vulnerable to Cross-site Scripting. Affects sjbr/static-info-tables versions < 2.3.1. Fixed in 2.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Static Info Tables (static_info_tables) extension for TYPO3 is a widely used package that provides static information about countries, languages, and currencies. It enhances TYPO3's functionality by allowing developers to easily integrate this data into their applications. However, prior to version 2.3.1, the package was susceptible to a Cross-site Scripting (XSS) vulnerability, which could be exploited by attackers to inject malicious scripts into web pages.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability in the Static Info Tables extension arises from insufficient input validation, allowing remote attackers to inject arbitrary web scripts or HTML through unspecified vectors. This could lead to unauthorized actions being performed on behalf of users, data theft, or the distribution of malware. The vulnerability is classified under CWE-79, indicating that it involves improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
2.3.1
This is the first release that contains the fix.
composer require sjbr/static-info-tables:2.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to sanitize any user input that is displayed on the web pages to prevent potential XSS attacks. This can be achieved by using functions that escape HTML characters, such as htmlspecialchars() in PHP.
Conclusion
The Static Info Tables extension for TYPO3 has a known XSS vulnerability that can be exploited by attackers. It is crucial to update to version 2.3.1 or later to protect your application from potential threats. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for sjbr/static-info-tables →
FAQ
Cross-site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential impacts include unauthorized actions on behalf of users, data theft, and the risk of spreading malware through compromised web pages.
Yes, you can sanitize user inputs and escape HTML characters to mitigate the risk of XSS attacks until you can update to the patched version.
If you encounter issues after updating, check the package documentation for any breaking changes and ensure that your application is compatible with the new version.
