CVE-2020-26227 — Cross-site Scripting in Typo3

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.4%
top 41.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Typo3Typo3 CMSTypo3 Cms-core+1 more
Timeline
PublishedNov 23
Latest updateDec 21

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶Packagisttypo3/cms-core9.0.0 — 9.5.23+2
▶Packagisttypo3/cms10.0.0 — 10.4.10+2
▶NVDtypo3/typo36.2.0 — 6.2.54+4
▶CVEListV5typo3/typo3.cms>= 10.0.0, < 10.4.10, >= 9.0.0, < 9.5.23+1

🔴Vulnerability Details

3
OSV
Cross-Site Scripting in Fluid view helpers↗2020-12-21
▶
GHSA
Cross-Site Scripting in Fluid view helpers↗2020-12-21
▶
CVEList
Cross-Site Scripting in Fluid view helpers↗2020-11-23
▶
CVE-2020-26227 — Cross-site Scripting in Typo3 | cvebase