CVE-2020-11070 Cross-Site Scripting in SVG Sanitizer
An attacker can execute arbitrary scripts in a victim's browser by submitting slightly invalid SVG markup that bypasses sanitization in the TYPO3 extension.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-11070?
CVE-2020-11070 is a medium-severity cross-site scripting vulnerability in TYPO3GmbH svg_sanitizer, published on 13 May 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. This is fixed in version 1.0.3.
Weakness: CWE-79
Which versions are affected by CVE-2020-11070?
2 open source packages ship an affected version, including t3g/svg-sanitizer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
t3g/svg-sanitizer Packagist | All versions | 1.0.3 |
t3g/svg-sanitizer Packagist | All versions | 1.0.3 |
Products include Typo3 Svg Sanitizer.
How do I fix CVE-2020-11070?
Upgrade t3g/svg-sanitizer to 1.0.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-11070 being exploited?
There is no known exploitation of CVE-2020-11070 in the wild and no public exploit code.
Sources
Also known as GHSA-59cf-m7v5-wh5w.