MEDIUM5.4
GHSA-28w5-j8xj-2xwc
Cross-site Scripting in the yoast_seo TYPO3 extension
Quick fix
GHSA-28w5-j8xj-2xwc — yoast-seo-for-typo3/yoast_seo: upgrade to the fixed version with the command below.
composer require yoast-seo-for-typo3/yoast_seo:^7.2.3Details
The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/yoast-seo-for-typo3/yoast_seo
Introduced in:
0Fixed in: 7.2.3Fix
composer require yoast-seo-for-typo3/yoast_seo:^7.2.3