CVE-2012-6146 — Cross-site Scripting in CMS

CWE-264CWE-79 — Cross-site Scripting4 documents4 sources
Severity
4.0MEDIUMNVD
EPSS
0.2%
top 60.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Typo3 CMSTypo3
Timeline
PublishedMay 20
Latest updateMay 17

Description

The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 8.0 | Impact: 2.9

Affected Packages2 packages

▶Packagisttypo3/cms4.5 — 4.5.21+2
▶NVDtypo3/typo343 versions+42

🔴Vulnerability Details

3
OSV
Typo3 Backend History Module Vulnerable to XSS↗2022-05-17
▶
GHSA
Typo3 Backend History Module Vulnerable to XSS↗2022-05-17
▶
CVEList
CVE-2012-6146: The Backend History Module in TYPO3 4↗2014-05-20
▶
CVE-2012-6146 — Cross-site Scripting in Typo3 CMS | cvebase