Vulnerability · Published Jun 16, 2023 · Assigned by mitre
CVE-2023-35783
Medium 6.3
In plain English
A medium-severity security flaw in the tpwd/ke_search package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 72.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The ke_search (aka Faceted Search) extension before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via indexed data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | tpwd/ke_search | 5.0.2 | GHSA-f4m6-x2xj-jc7w |
| Packagist | tpwd/ke_search | 4.6.6 | GHSA-f4m6-x2xj-jc7w |
| Packagist | tpwd/ke_search | 4.0.3 | GHSA-f4m6-x2xj-jc7w |