Log in Start free

Vulnerability · Published May 13, 2020 · Assigned by GitHub_M

CVE-2020-11065Cross-Site Scripting in TYPO3 CMS

Medium 5.4

In plain English

A medium-severity cross-site scripting in TYPO3 CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.5%top 54.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagisttypo3/cms10.4.2GHSA-4j77-gg36-9864
Packagisttypo3/cms9.5.17GHSA-4j77-gg36-9864
Packagisttypo3/cms-core10.4.2GHSA-4j77-gg36-9864
Packagisttypo3/cms-core9.5.17GHSA-4j77-gg36-9864

Affected products (as reported)

VendorProductVersions
TYPO3 TYPO3 CMS >= 9.5.12, < 9.5.17>= 10.2.0, < 10.4.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References