MEDIUM4.8

GHSA-3w22-wrwx-2r75

Typo3 XSS Vulnerability

Quick fix

GHSA-3w22-wrwx-2r75 — typo3/cms: upgrade to the fixed version with the command below.

composer require typo3/cms:^9.2.0

Details

The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a crafted site name during the installation process.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/typo3/cms

Introduced in: 0Fixed in: 9.2.0

Fixcomposer require typo3/cms:^9.2.0

References

https://nvd.nist.gov/vuln/detail/CVE-2018-6905[ADVISORY]
https://github.com/TYPO3/typo3/commit/d2c0ea7db3b31a796a82f9d39f77f9983beb7c35[WEB]
https://forge.typo3.org/issues/84191[WEB]
https://github.com/pradeepjairamani/TYPO3-XSS-POC[WEB]
http://www.securitytracker.com/id/1040755[WEB]