PT-2024-40530 · Packagist · Typo3/Cms

Published 2024-06-07 · Updated 2024-06-07

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions.

Description: The issue concerns cross-site scripting vulnerabilities related to t3:// URL handling and typolink functionality. Both regular backend forms and frontend extensions using rendering with typolink are affected.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-XGMX-J3HV-JH9X

Affected Products

Typo3/Cms

References · 7

• https://osv.dev/vulnerability/GHSA-xgmx-j3hv-jh9x · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-12-17-2.yaml · Note
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/commit/25f796b94e23bac77e836bd38f53ce998c094901 · Note
• https://github.com/TYPO3/typo3/commit/a35c42e9bcb020e16016d1c146354513a9856bc0 · Note
• https://github.com/TYPO3/typo3/commit/64db88b9b61bb67b3b44145dc8e0e1ef251da45e · Note
• https://typo3.org/security/advisory/typo3-core-sa-2019-022 · Note