TYPO3 Cross-Site Scripting in Language Pack Handling
Summary
GHSA-76r3-m635-p3vc: TYPO3 Cross-Site Scripting in Language Pack Handling. Affects typo3/cms-core versions >= 9.2.0, < 9.5.4. Fixed in 9.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system used for building and managing websites. The TYPO3 CMS Core package is a fundamental component of TYPO3 CMS, providing essential functionality for the system. Language packs are used to translate the TYPO3 CMS interface into different languages, allowing users to interact with the system in their preferred language. However, a vulnerability has been discovered in the language pack handling of the TYPO3 CMS Core package, which can lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the failure to properly encode information from external sources in the language pack handling of the TYPO3 CMS Core package's install tool. This allows an attacker to inject malicious scripts into the system, which can be executed in the context of a user's browser. If successfully exploited, this vulnerability can lead to various consequences, such as unauthorized access to sensitive information, session hijacking, or the manipulation of website content. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.5.4
This is the first release that contains the fix.
composer require typo3/cms-core:9.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the TYPO3 CMS Core package to the latest version to mitigate the risk of exploitation.
Conclusion
The TYPO3 CMS Core package is vulnerable to cross-site scripting (XSS) attacks in its language pack handling. To mitigate this vulnerability, it is recommended to update the TYPO3 CMS Core package to version 9.5.4 or later. This update includes a patch that properly encodes information from external sources, preventing the injection of malicious scripts. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS is an open-source content management system used for building and managing websites. It provides a flexible and extensible platform for creating web applications.
Language packs in TYPO3 CMS are used to translate the system's interface into different languages, allowing users to interact with the CMS in their preferred language.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or manipulating website content.
If exploited, this vulnerability can result in unauthorized access to sensitive information, session hijacking, or the manipulation of website content.
To protect your TYPO3 CMS installation, it is crucial to update the TYPO3 CMS Core package to version 9.5.4 or later. This update includes a fix for the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
