TYPO3 Cross-Site Scripting in Form Framework validation handling
Summary
GHSA-95qm-3xp7-vfj5: TYPO3 Cross-Site Scripting in Form Framework validation handling. Affects typo3/cms-core across 3 version ranges.
>= 8.0.0, < 8.7.30
>= 9.0.0, < 9.5.12
>= 10.0.0, < 10.2.1
Fixed in 8.7.30, 9.5.12 or 10.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. The TYPO3 CMS Core package is responsible for the core functionality of the system, including the Form Framework. The Form Framework provides a set of tools for creating and handling forms on TYPO3 websites.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability has been discovered in the Form Framework of TYPO3 CMS. This vulnerability allows an attacker to inject malicious code into the output of field validation errors. When a user submits a form with invalid data, the error message displayed on the website can contain the injected code. If a victim user interacts with this error message, the injected code can be executed in their browser, potentially leading to unauthorized actions or data theft.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.308.7.30composer require typo3/cms-core:8.7.30 -
>= 9.0.0, < 9.5.129.5.12composer require typo3/cms-core:9.5.12 -
>= 10.0.0, < 10.2.110.2.1composer require typo3/cms-core:10.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to immediately update TYPO3 CMS Core, you can mitigate the risk of this vulnerability by sanitizing and escaping user input before displaying it in error messages. Ensure that all user-supplied data is properly validated and sanitized to prevent the execution of malicious code.
Conclusion
The XSS vulnerability in the Form Framework of TYPO3 CMS can pose a significant risk to websites using this package. It is crucial to update TYPO3 CMS Core to the latest version or apply the recommended workaround to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and extensions for building and customizing websites.
The Form Framework is a component of TYPO3 CMS that provides tools for creating and handling forms on websites. It allows developers to define form fields, validation rules, and form submission handling.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, perform unauthorized actions, or deface websites.
The XSS vulnerability in the Form Framework of TYPO3 CMS can allow an attacker to execute arbitrary code in the context of a victim user's browser. This can lead to unauthorized actions, data theft, or the compromise of user accounts.
To update TYPO3 CMS Core, you can run the command 'composer update typo3/cms-core' in your project's root directory. Make sure to update to version 10.2.1 or later, as this includes the patch for the XSS vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
