PT-2024-40076 · Typo3 · Typo3

Published 2024-05-30 · Updated 2024-05-30

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Typo3 (affected versions not specified)

Description: A cross-site scripting issue has been found in the handling of t3:// URL and typolink functionality. This affects not only regular backend forms but also frontend extensions that use rendering with typolink.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-4PPR-JW47-9QM5

Affected Products

Typo3

References · 7

• https://osv.dev/vulnerability/GHSA-4ppr-jw47-9qm5 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-12-17-2.yaml · Note
• https://github.com/TYPO3-CMS/core · Note
• https://github.com/TYPO3-CMS/core/commit/d2823a451d65ac59dd42ec54c92903d70d29c813 · Note
• https://github.com/TYPO3-CMS/core/commit/280908c9472aa5e1d9ee005327bbb9aed53f613a · Note
• https://github.com/TYPO3-CMS/core/commit/89f5817c09a50d8d60821158d651bd618521164e · Note
• https://typo3.org/security/advisory/typo3-core-sa-2019-022 · Note