PT-2020-14306 · Typo3 · Typo3Fluid/Fluid

Bill Dagou · Published 2020-10-08 · Updated 2024-03-06 · CVE-2020-15241

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions typo3fluid/fluid versions prior to 2.0.5 typo3fluid/fluid versions prior to 2.1.4 typo3fluid/fluid versions prior to 2.2.1 typo3fluid/fluid versions prior to 2.3.5 typo3fluid/fluid versions prior to 2.4.1 typo3fluid/fluid versions prior to 2.5.5 typo3fluid/fluid versions prior to 2.6.1

Description The issue is related to cross-site scripting when using the ternary conditional operator in templates, such as {showFullName ? fullName : defaultValue}.

Recommendations Update to version 2.0.5 or later of the typo3fluid/fluid package to fix the issue. Update to version 2.1.4 or later of the typo3fluid/fluid package to fix the issue. Update to version 2.2.1 or later of the typo3fluid/fluid package to fix the issue. Update to version 2.3.5 or later of the typo3fluid/fluid package to fix the issue. Update to version 2.4.1 or later of the typo3fluid/fluid package to fix the issue. Update to version 2.5.5 or later of the typo3fluid/fluid package to fix the issue. Update to version 2.6.1 or later of the typo3fluid/fluid package to fix the issue. As a temporary workaround, consider avoiding the use of the ternary conditional operator in templates until a patch is available.

Exploit

Fix

XSS

Open Redirect

Weakness Enumeration

CWE-79

CWE-601

Related Identifiers

BIT-TYPO3-2020-15241

CVE-2020-15241

GHSA-7733-HJV6-4H47

Affected Products

Typo3Fluid/Fluid

References · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3fluid/fluid/CVE-2020-15241.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-15241.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-15241.yaml · Exploit
• 🔥 https://github.com/TYPO3/Fluid/security/advisories/GHSA-7733-hjv6-4h47 · Exploit
• 🔥 https://typo3.org/security/advisory/typo3-core-sa-2019-013 · Exploit
• https://github.com/TYPO3/Fluid/commit/9ef6a8ffff2e812025fc0701b4ce72eea6911a3d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15241 · Security Note
• https://osv.dev/vulnerability/BIT-typo3-2020-15241 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7733-hjv6-4h47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15241 · Vendor Advisory
• https://github.com/TYPO3/Fluid · Note
• https://t.me/cibsecurity/15167 · Telegram Post