CVE-2020-11064: TYPO3 CMS HTML Placeholder Attribute Cross-Site Scripting
Summary
CVE-2020-11064: In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placeholder attributes containing data of other database records... Affects typo3 across 2 version ranges.
>= 9.0.0, < 9.5.17
>= 10.0.0, < 10.4.2
Fixed in 9.5.17 or 10.4.2, depending on the release line you run. How to fix ↓
Also tracked for
- typo3/cms-core · Packagist
The same CVE-2020-11064 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a flexible and extensible platform for developers and offers various features such as multi-language support, user management, and content editing. However, versions of TYPO3 CMS prior to 9.5.17 and 10.4.2 are vulnerable to a cross-site scripting (XSS) attack through HTML placeholder attributes. This vulnerability can be exploited by an authenticated backend user and may lead to the execution of malicious scripts in the context of the affected user's session.
Vulnerability Detail
The vulnerability in TYPO3 CMS arises from the improper handling of HTML placeholder attributes. These attributes can contain data from other database records, which are not properly sanitized before being rendered in the HTML output. An attacker with a valid backend user account can exploit this vulnerability by crafting a malicious placeholder attribute that includes a script tag. When the affected page is viewed by another user, the script will be executed in their browser, potentially leading to session hijacking, data theft, or other malicious activities. This vulnerability has been assigned the identifier CVE-2020-11064 and has a CVSSv3 score of 6.1 (Medium severity).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.5.179.5.17 -
>= 10.0.0, < 10.4.210.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the placeholder attribute values before rendering them in the HTML output. This can be done by using appropriate sanitization functions or libraries to remove any potentially malicious content. However, this workaround is not recommended as it may introduce additional complexities and may not provide complete protection against all possible attack vectors. It is strongly advised to apply the official patches or upgrade to the latest version of TYPO3 CMS.
Conclusion
In conclusion, TYPO3 CMS versions prior to 9.5.17 and 10.4.2 are vulnerable to a cross-site scripting (XSS) attack through HTML placeholder attributes. This vulnerability can be exploited by an authenticated backend user and may lead to the execution of malicious scripts in the context of other users. To mitigate this risk, users should upgrade to the latest version of TYPO3 CMS or apply the official patches. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for typo3 →
FAQ
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a flexible and extensible platform for developers and offers various features such as multi-language support, user management, and content editing.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate website content, or perform other unauthorized actions.
This vulnerability can be exploited by an authenticated backend user who can create or edit content in TYPO3 CMS. By crafting a malicious placeholder attribute that includes a script tag, the attacker can execute arbitrary scripts in the context of other users who view the affected page.
The impact of this vulnerability depends on the intentions of the attacker. It could potentially lead to session hijacking, data theft, or the injection of malicious content into the affected website. The severity of the impact may vary depending on the privileges of the affected user and the sensitivity of the data being accessed.
To protect your TYPO3 CMS installation, it is recommended to upgrade to the latest version (9.5.17 or 10.4.2) that includes the necessary patches to address this vulnerability. Regularly updating TYPO3 CMS and following best practices for web application security can help mitigate the risk of such vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3.
