Typo3 CMS - Cross-Site Scripting in Language Pack Handling
Summary
GHSA-259v-xm34-p7fr: Typo3 Cross-Site Scripting in Language Pack Handling. Affects typo3/cms versions >= 9.0.0, < 9.5.4. Fixed in 9.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Typo3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities, including language pack handling in the install tool. This feature allows users to install and manage language packs for multilingual websites. However, a vulnerability has been discovered in the language pack handling functionality that makes it susceptible to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in Typo3 CMS arises from a failure to properly encode information from external sources in the language pack handling feature of the install tool. This allows an attacker to inject malicious scripts into the website, which can be executed in the context of the victim's browser. The impact of this vulnerability can range from unauthorized access to sensitive information to complete takeover of the affected website. The vulnerability has been assigned a severity level of MODERATE.
How To Fix
Minimum fixed version
9.5.4
This is the first release that contains the fix.
composer require typo3/cms:9.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of Typo3 CMS.
Conclusion
The vulnerability in Typo3 CMS's language pack handling feature exposes websites to cross-site scripting attacks. Users are advised to upgrade to the latest version of Typo3 CMS to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
Typo3 CMS is an open-source content management system that allows users to create and manage websites.
The install tool in Typo3 CMS is a feature that allows users to perform various administrative tasks, including installing language packs for multilingual websites.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The impact of this vulnerability can range from unauthorized access to sensitive information to complete takeover of the affected website.
To protect your Typo3 CMS installation, it is recommended to upgrade to version 9.5.4 or later, which includes a fix for this vulnerability. Additionally, regularly updating your CMS and applying security patches is crucial for maintaining a secure environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
