MEDIUM6.1
GHSA-p78x-93mq-qwqh
TYPO3 vulnerable to Cross-Site Scripting in the textarea view helper
Quick fix
GHSA-p78x-93mq-qwqh — typo3/cms-fluid: upgrade to the fixed version with the command below.
composer require typo3/cms-fluid:^4.3.4Details
TYPO3 before 4.3.4 and 4.4.x before 4.4.1 allows XSS in the textarea view helper in an extbase extension.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/typo3/cms-fluid
Introduced in:
4.4.0Fixed in: 4.4.1Fix
composer require typo3/cms-fluid:^4.4.1References
- https://nvd.nist.gov/vuln/detail/CVE-2010-3672[ADVISORY]
- https://github.com/TYPO3/typo3/commit/5f13c2276c8b753ceb76b31d1034a47c781d302a[WEB]
- https://github.com/TYPO3/typo3/commit/fc2b43503d871b42c0e0094ea55756c089b536ea[WEB]
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719[WEB]
- https://github.com/TYPO3-CMS/core[PACKAGE]
- https://github.com/TYPO3-CMS/fluid/blob/cbce111326850c247729f097b2d1fb735e513906/Classes/ViewHelpers/Form/TextareaViewHelper.php[WEB]
- https://security-tracker.debian.org/tracker/CVE-2010-3672[WEB]
- https://typo3.org/security/advisory/typo3-sa-2010-012/#XSS[WEB]