MEDIUM5.4
GHSA-2rcw-9hrm-8q7q
TYPO3 Cross-Site Scripting in Frontend User Login
Quick fix
GHSA-2rcw-9hrm-8q7q — typo3/cms: upgrade to the fixed version with the command below.
composer require typo3/cms:^7.6.32Details
Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile.
Template patterns that are affected are
- ###FEUSER_[fieldName]### using system extension felogin - <!--###USERNAME###--> for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/TYPO3/typo3/commit/1c85fe70269e2ff8ecf0b6d5f16550c6cd0ddc78[WEB]
- https://github.com/TYPO3/typo3/commit/373bec5d7d415f0764ebbadc7970610dc26da068[WEB]
- https://github.com/TYPO3/typo3/commit/e4143195e1451630f058a58ab62d92135948a927[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-3.yaml[WEB]
- https://github.com/TYPO3/typo3[PACKAGE]
- https://typo3.org/security/advisory/typo3-core-sa-2018-008[WEB]