CVE-2009-0816
published 2009-03-05CVE-2009-0816: Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2…
PriorityP416medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.06%
60.2th percentile
Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| typo3 | cms | >= 3.3.0 | — |
| typo3 | cms | >= 4.0 < 4.0.12 | 4.0.12 |
| typo3 | cms | >= 4.1.0 < 4.1.10 | 4.1.10 |
| typo3 | cms | >= 4.2.0 < 4.2.6 | 4.2.6 |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Typo3 Backend XSS Vulnerability
ghsa·2022-05-02
CVE-2009-0816 [MEDIUM] CWE-79 Typo3 Backend XSS Vulnerability
Typo3 Backend XSS Vulnerability
An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided files, allows a remote attacker to read arbitrary files on a host.
The expected value of a mandatory hash secret, intended to invalidate such requests, is exposed to remote users allowing them to bypass access control by providing the correct value.
There's no authentication required to exploit this vulnerability. The vulnerability allows to read any file, the web server user account has access to.
OSV
Typo3 Backend XSS Vulnerability
osv·2022-05-02
CVE-2009-0816 [MEDIUM] Typo3 Backend XSS Vulnerability
Typo3 Backend XSS Vulnerability
An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided files, allows a remote attacker to read arbitrary files on a host.
The expected value of a mandatory hash secret, intended to invalidate such requests, is exposed to remote users allowing them to bypass access control by providing the correct value.
There's no authentication required to exploit this vulnerability. The vulnerability allows to read any file, the web server user account has access to.
No detection rules found.
http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/http://www.debian.org/security/2009/dsa-1720http://www.openwall.com/lists/oss-security/2009/02/10/6http://www.securitytracker.com/id?1021709http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/http://www.debian.org/security/2009/dsa-1720http://www.openwall.com/lists/oss-security/2009/02/10/6http://www.securitytracker.com/id?1021709
2009-03-05
Published