Cross-Site Scripting in typo3/cms
Summary
GHSA-qmwf-j7g7-f5jw: Cross-Site Scripting in third party library mso/idna-convert. Affects typo3/cms across 2 version ranges.
>= 7.6.0, < 7.6.10
>= 8.0.0, < 8.2.1
Fixed in 7.6.10 or 8.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
typo3/cms is an open-source content management system (CMS) written in PHP. It provides a range of features for building and managing websites, including a powerful templating engine, user management, and extensibility through plugins. However, a vulnerability has been discovered in the third-party library mso/idna-convert used by typo3/cms, which can lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the exposure of the vendor directory to the publicly accessible document root. This allows an attacker to inject malicious scripts into web pages, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability has a moderate severity rating and is classified as CWE-79.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.6.0, < 7.6.107.6.10composer require typo3/cms:7.6.10 -
>= 8.0.0, < 8.2.18.2.1composer require typo3/cms:8.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, the typo3/cms package is vulnerable to cross-site scripting (XSS) attacks due to the exposure of the vendor directory. It is important to take the recommended steps to fix this vulnerability and protect websites using typo3/cms. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
typo3/cms is an open-source content management system written in PHP. It provides a range of features for building and managing websites.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability can lead to unauthorized access, data theft, or other malicious activities on websites using typo3/cms.
To fix this vulnerability, ensure that the vendor directory is not exposed to the publicly accessible document root and configure a dedicated web folder in composer-managed installations.
No specific workaround has been provided for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
