Log in Start free

Vulnerability · Published Dec 13, 2022 · Assigned by GitHub_M

CVE-2022-23499Cross-Site Scripting Protection bypass in HTML Sanitizer

Medium 6.1

In plain English

A medium-severity cross-site scripting in html-sanitizer from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the upstream package masterminds/html5. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. The upstream package masterminds/html5 provides HTML raw text elements (`script`, `style`, `noframes`, `noembed` and `iframe`) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that's why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting. This issue has been fixed in versions 1.5.0 and 2.1.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagisttypo3/cms10.4.33GHSA-hvwx-qh2h-xcfj
Packagisttypo3/cms11.5.20GHSA-hvwx-qh2h-xcfj
Packagisttypo3/cms12.1.1GHSA-hvwx-qh2h-xcfj
Packagisttypo3/html-sanitizer1.5.0GHSA-hvwx-qh2h-xcfj
Packagisttypo3/html-sanitizer2.1.1GHSA-hvwx-qh2h-xcfj

Affected products (as reported)

VendorProductVersions
TYPO3 html-sanitizer >= 1.0.0, < 1.5.0>= 2.0.0, < 2.1.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References