Typo3 · Typo3Fluid/Fluid · CVE-2020-15241
**Name of the Vulnerable Software and Affected Versions**
typo3fluid/fluid versions prior to 2.0.5
typo3fluid/fluid versions prior to 2.1.4
typo3fluid/fluid versions prior to 2.2.1
typo3fluid/fluid versions prior to 2.3.5
typo3fluid/fluid versions prior to 2.4.1
typo3fluid/fluid versions prior to 2.5.5
typo3fluid/fluid versions prior to 2.6.1
**Description**
The issue is related to cross-site scripting when using the ternary conditional operator in templates, such as `{showFullName ? fullName : defaultValue}`.
**Recommendations**
Update to version 2.0.5 or later of the typo3fluid/fluid package to fix the issue.
Update to version 2.1.4 or later of the typo3fluid/fluid package to fix the issue.
Update to version 2.2.1 or later of the typo3fluid/fluid package to fix the issue.
Update to version 2.3.5 or later of the typo3fluid/fluid package to fix the issue.
Update to version 2.4.1 or later of the typo3fluid/fluid package to fix the issue.
Update to version 2.5.5 or later of the typo3fluid/fluid package to fix the issue.
Update to version 2.6.1 or later of the typo3fluid/fluid package to fix the issue.
As a temporary workaround, consider avoiding the use of the ternary conditional operator in templates until a patch is available.