Cross-Site Scripting in TYPO3 component Indexed Search
Summary
GHSA-wh8q-72cp-p5wf: Cross-Site Scripting in TYPO3 component Indexed Search. Affects typo3/cms versions >= 6.2.0, < 6.2.16. Fixed in 6.2.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. The Indexed Search component in TYPO3 provides a search functionality for websites. It allows users to search for specific content within the website. However, a vulnerability has been discovered in the Indexed Search component that allows authenticated editors to inject arbitrary HTML into the search result view. This vulnerability arises from a failure to properly encode editor input, making the website susceptible to Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in the TYPO3 component Indexed Search allows authenticated editors to inject arbitrary HTML into the search result view. This means that an attacker with editor privileges can insert malicious code that will be executed by the victim's browser when they view the search results. This can lead to various security risks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the victim. The vulnerability exists in TYPO3 versions 6.2.0 to 6.2.16.
How To Fix
Minimum fixed version
6.2.16
This is the first release that contains the fix.
composer require typo3/cms:6.2.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are strongly encouraged to upgrade to the latest version of TYPO3 to mitigate the risk.
Conclusion
The Cross-Site Scripting vulnerability in the TYPO3 component Indexed Search can allow authenticated editors to inject arbitrary HTML into the search result view. This can lead to various security risks, such as stealing sensitive information or performing actions on behalf of the victim. TYPO3 users are advised to upgrade to the latest version (6.2.17 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 CMS is an open-source content management system that allows users to create and manage websites.
The Indexed Search component in TYPO3 provides a search functionality for websites, allowing users to search for specific content within the website.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The potential risks of this vulnerability include stealing sensitive information, session hijacking, and performing actions on behalf of the victim.
To protect your TYPO3 website from this vulnerability, you should upgrade to the latest version of TYPO3 (6.2.17 or later).
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
