CVE-2020-26229 — XML External Entity (XXE) Injection in Typo3

CWE-611 — XML External Entity (XXE) Injection4 documents4 sources
Severity
3.7LOWNVD
EPSS
0.3%
top 49.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Typo3Typo3 CMSTypo3 Cms-core+1 more
Timeline
PublishedNov 23

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploite…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:LExploitability: 1.2 | Impact: 2.5

Affected Packages4 packages

▶Packagisttypo3/cms10.0.0 — 10.4.10
▶NVDtypo3/typo310.0.0 — 10.4.10
▶Packagisttypo3/cms-core10.0.0 — 10.4.10
▶CVEListV5typo3/typo3.cms>= 10.0.0, < 10.4.10

🔴Vulnerability Details

3
OSV
XML External Entity in Dashboard Widget↗2020-11-23
▶
GHSA
XML External Entity in Dashboard Widget↗2020-11-23
▶
CVEList
XML External Entity in Dashboard Widget↗2020-11-23
▶
CVE-2020-26229 — XML External Entity (XXE) Injection | cvebase