GHSA-3w22-wrwx-2r75

ghsaUSosv

Typo3 XSS Vulnerability

view advisory published 2022-05-14Licence: CC-BY-4.0

The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a crafted site name during the installation process.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-6905US	medium4.8	2.17% (82nd)	Exploit	2018-04-08
The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the i…

references

External citations — patches, advisories, analysis.

http://www.securitytracker.com/id/1040755WEB
https://forge.typo3.org/issues/84191WEB
https://github.com/TYPO3/typo3/commit/d2c0ea7db3b31a796a82f9d39f77f9983beb7c35WEB
https://github.com/pradeepjairamani/TYPO3-XSS-POCWEB
https://nvd.nist.gov/vuln/detail/CVE-2018-6905ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan