PT-2012-4789 · Typo3 · Typo3

Andreas Schnapp + 1 · Publicado 2012-09-05 · Atualizado 2022-05-17 · CVE-2012-3530

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.5.x through 4.5.18 TYPO3 versions 4.6.x through 4.6.11 TYPO3 versions 4.7.x through 4.7.3

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events, due to an incomplete blacklist vulnerability in the t3lib div::quoteJSvalue API function.

Recommendations For versions 4.5.x through 4.5.18, update to version 4.5.19 or later. For versions 4.6.x through 4.6.11, update to version 4.6.12 or later. For versions 4.7.x through 4.7.3, update to version 4.7.4 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-3530

DSA-2537-1

GHSA-94C2-G68F-9R98

Produtos afetados

Typo3

Referências · 9

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3530 · Nota
• http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004 · Aviso do Fabricante
• http://secunia.com/advisories/50287 · Aviso do Fabricante
• http://debian.org/security/2012/dsa-2537 · Aviso do Fabricante
• http://osvdb.org/84772 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77794 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3530 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/08/22/8 · Nota
• https://osv.dev/vulnerability/GHSA-94c2-g68f-9r98 · Aviso do Fabricante