Cross-Site Scripting Vulnerability in TYPO3 Form Framework (GHSA-4h5c-5g25-v7fh)
Summary
GHSA-4h5c-5g25-v7fh: TYPO3 Cross-Site Scripting in Form Framework. Affects typo3/cms across 2 version ranges.
>= 8.0.0, < 8.7.23
>= 9.0.0, < 9.5.4
Fixed in 8.7.23 or 9.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) that enables users to create and manage websites efficiently. The system extension 'form' within TYPO3 allows developers to build and manage frontend forms. However, this extension has been found to be vulnerable to cross-site scripting (XSS) attacks due to improper encoding of user input, which can lead to security breaches.
Vulnerability Detail
The vulnerability arises from the failure to properly encode user input in frontend forms managed by the TYPO3 form framework. This oversight can allow attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft, session hijacking, or other malicious activities. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.238.7.23composer require typo3/cms:8.7.23 -
>= 9.0.0, < 9.5.49.5.4composer require typo3/cms:9.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, ensure that user inputs are properly sanitized and validated before being processed by the form framework. This can help mitigate the risk of XSS attacks until the package is updated.
Conclusion
The TYPO3 form framework is vulnerable to cross-site scripting due to improper encoding of user input. It is crucial for users to update their TYPO3 installations to the latest patched versions to mitigate this risk. Additionally, employing best practices for input validation can help prevent such vulnerabilities in the future.
See every vulnerability recorded for typo3/cms →
FAQ
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If exploited, this vulnerability can lead to data theft, unauthorized actions on behalf of users, and compromise of user sessions.
Yes, implementing proper input validation and output encoding can significantly reduce the risk of XSS attacks.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
