PT-2017-4834 · Typo3 · Typo3/Cms

Helmut Hummel + 1 · Published 2017-10-20 · Updated 2022-05-17 · CVE-2010-3659

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 4.1.x through 4.1.13 TYPO3 CMS versions 4.2.x through 4.2.12 TYPO3 CMS versions 4.3.x through 4.3.3 TYPO3 CMS versions 4.4.x through 4.4.0

Description: The issue allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager or unspecified parameters to unknown backend forms.

Recommendations: For versions 4.1.x through 4.1.13, update to version 4.1.14 or later. For versions 4.2.x through 4.2.12, update to version 4.2.13 or later. For versions 4.3.x through 4.3.3, update to version 4.3.4 or later. For versions 4.4.x through 4.4.0, update to version 4.4.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-3659

DSA-2098-1

GHSA-JR79-65XR-Q7CX

Affected Products

Typo3/Cms

References · 10

• https://security-tracker.debian.org/tracker/CVE-2010-3659 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3659 · Security Note
• https://osv.dev/vulnerability/GHSA-jr79-65xr-q7cx · Vendor Advisory
• https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-012 · Vendor Advisory
• https://github.com/TYPO3-CMS/backend · Note
• https://web.archive.org/web/20120903133822/http://securityfocus.com/bid/42029 · Note
• http://securityfocus.com/bid/42029 · Note
• http://openwall.com/lists/oss-security/2010/09/28/8 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3659 · Note
• http://openwall.com/lists/oss-security/2014/02/12/8 · Note