CVE-2015-8756: TYPO3 CMS Indexed Search Cross-site Scripting Vulnerability
Summary
CVE-2015-8756: TYPO3 CMS indexed search Cross-site Scripting vulnerability. Affects typo3/cms versions >= 6.2.0, < 6.2.16. Fixed in 6.2.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) that enables users to create and manage websites. It is known for its flexibility, scalability, and extensibility, making it suitable for a wide range of applications from small websites to large enterprise solutions. The Indexed Search component in TYPO3 allows users to search through indexed content. However, a vulnerability in this component has been identified that could allow attackers to exploit the system.
Vulnerability Detail
The vulnerability is a Cross-site Scripting (XSS) flaw found in the search result view of the Indexed Search component in TYPO3 versions 6.2.x prior to 6.2.16. This issue allows remote authenticated editors to inject arbitrary web scripts or HTML into the search results via unspecified vectors. If exploited, this could lead to unauthorized actions being performed on behalf of the user, data theft, or other malicious activities.
How To Fix
Minimum fixed version
6.2.16
This is the first release that contains the fix.
composer require typo3/cms:6.2.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Indexed Search component to trusted users only. This can be done by adjusting user permissions in the TYPO3 backend to limit who can access and utilize the search functionality.
Conclusion
The TYPO3 CMS Indexed Search component has a critical XSS vulnerability that can be exploited by authenticated users. It is essential to update to the latest version to mitigate risks associated with this vulnerability. Regular monitoring and updates are crucial for maintaining the security of your applications.
See every vulnerability recorded for typo3/cms →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and security.
You can check your TYPO3 version in the backend or use tools like Vulert to monitor and alert for open-source vulnerabilities in your software.
Not addressing this vulnerability could lead to unauthorized access, data theft, or the ability for attackers to perform actions on behalf of legitimate users.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.4, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
