PT-2023-21841 · Unknown · Fluid Components

Helmut Hummel · Published 2023-03-27 · Updated 2024-10-28 · CVE-2023-28604

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions fluid components extension versions prior to 3.5.0

Description The issue allows Cross-Site Scripting (XSS) via a component argument parameter, specifically in certain {content} use cases that may be edge cases. All versions of the Fluid Components extension before 3.5.0 were susceptible to this issue.

Recommendations For versions prior to 3.5.0, update to version 3.5.0 of the extension to fix the issue. Additionally, review and adjust your project's Fluid templates as necessary to prevent unwanted double-escaping of HTML markup.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28604

GHSA-8648-H559-8H42

Affected Products

Fluid Components

References · 8

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/sitegeist/fluid-components/CVE-2023-28604.yaml · Exploit
• 🔥 https://github.com/sitegeist/fluid-components/blob/master/Documentation/XssIssue.md · Exploit
• https://typo3.org/security/advisory/typo3-ext-sa-2023-003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28604 · Security Note
• https://osv.dev/vulnerability/GHSA-8648-h559-8h42 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28604 · Vendor Advisory
• https://github.com/sitegeist/fluid-components · Note
• https://twitter.com/CVEnew/status/1734626782018728204 · Twitter Post