PT-2020-14474 · Typo3 · Ke Search

Torben Hansen · Published 2020-07-07 · Updated 2022-05-24 · CVE-2020-15517

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ke search extension versions 2.8.2 and earlier ke search extension versions 3.x through 3.1.3

Description The issue allows for XSS.

Recommendations For ke search extension versions 2.8.2 and earlier, update to a version later than 2.8.2. For ke search extension versions 3.x through 3.1.3, update to a version later than 3.1.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-15517

GHSA-GG48-MPP8-CGQC

Affected Products

Ke Search

References · 9

• https://osv.dev/vulnerability/CVE-2020-15517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15517 · Security Note
• https://osv.dev/vulnerability/GHSA-gg48-mpp8-cgqc · Vendor Advisory
• https://github.com/tpwd/ke_search/commit/1cde32c3ebfcb6cda5d364f099979be9741f6714 · Note
• https://github.com/tpwd/ke_search · Note
• https://github.com/tpwd/ke_search/commit/9551aa4eef441a3e9825776d4a19ee4b6fe6f8ea · Note
• https://typo3.org/help/security-advisories · Note
• https://t.me/cvenotify/4915 · Telegram Post
• https://typo3.org/security/advisory/typo3-ext-sa-2020-009 · Note