PT-2020-12526 · Typo3 · Typo3/Cms

Josef Glatz · Published 2020-05-13 · Updated 2024-03-06 · CVE-2020-11065

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 9.5.12 through 9.5.16 TYPO3 CMS versions 10.2.0 through 10.4.1

Description The issue concerns link tags generated by typolink functionality, which are vulnerable to cross-site scripting. Properties being assigned as HTML attributes have not been parsed correctly.

Recommendations Update to version 9.5.17 to resolve the issue for versions 9.5.12 through 9.5.16. Update to version 10.4.2 to resolve the issue for versions 10.2.0 through 10.4.1.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-TYPO3-2020-11065

CVE-2020-11065

GHSA-4J77-GG36-9864

Affected Products

Typo3/Cms

References · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-11065.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-11065.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2020-11065 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2020-11065 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11065 · Security Note
• https://osv.dev/vulnerability/GHSA-4j77-gg36-9864 · Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4j77-gg36-9864 · Note
• https://t.me/cvenotify/3774 · Telegram Post
• https://typo3.org/security/advisory/typo3-core-sa-2020-003 · Note