Cross-Site Scripting in TYPO3 CMS
Summary
GHSA-5gr6-97fv-52cc: Cross-Site Scripting in TYPO3 CMS. Affects typo3/cms across 2 version ranges.
>= 7.6.0, < 7.6.16
>= 8.0.0, < 8.6.1
Fixed in 7.6.16 or 8.6.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities, making it a popular choice for website development. However, several versions of TYPO3 CMS are vulnerable to Cross-Site Scripting (XSS) attacks. XSS occurs when user input is not properly encoded, allowing malicious actors to inject and execute arbitrary code on the affected website.
Vulnerability Detail
The vulnerability in TYPO3 CMS arises from the failure to adequately encode user input in various parts of the system. This oversight makes it possible for attackers to inject malicious scripts or HTML code, which can then be executed by unsuspecting users visiting the affected website. The consequences of a successful XSS attack can range from defacement of the website to the theft of sensitive user information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.6.0, < 7.6.167.6.16composer require typo3/cms:7.6.16 -
>= 8.0.0, < 8.6.18.6.1composer require typo3/cms:8.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, website administrators can implement a Content Security Policy (CSP) to mitigate the risk of XSS attacks. CSP allows administrators to define a whitelist of trusted sources for content, reducing the likelihood of malicious scripts being executed. Here is an example of a CSP header that can be added to the website's HTTP response:
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'
Conclusion
Cross-Site Scripting (XSS) is a serious vulnerability that affects several versions of TYPO3 CMS. It is crucial for website administrators and developers to promptly address this issue by updating to the latest secure version and implementing proper input validation and output encoding. Failure to do so may expose websites and users to potential attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or HTML code into web pages viewed by other users. This can lead to various consequences, such as data theft, session hijacking, or website defacement.
The XSS vulnerability in TYPO3 CMS allows attackers to inject and execute arbitrary code on affected websites. This can result in website defacement, unauthorized access to user data, or the spread of malware to visitors.
The vulnerability affects TYPO3 CMS versions 7.6.0 to 7.6.16 and versions 8.0.0 to 8.6.1. It is recommended to update to the latest secure version to mitigate the risk.
At the time of this report, there are no known public exploits specifically targeting this vulnerability in TYPO3 CMS. However, it is important to address the issue promptly to prevent potential exploitation.
More information about the vulnerability, including its technical details and the fixed versions of TYPO3 CMS, can be found in the official advisory provided by TYPO3 CMS: [link to the advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
