CVE-2020-15241 Cross-Site Scripting in TYPO3 Fluid Engine
Cross-site scripting vulnerability in TYPO3 Fluid Engine allows attackers to inject malicious scripts via ternary operators in templates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-15241?
CVE-2020-15241 is a medium-severity cross-site scripting vulnerability in Typo3 Typo3, published on 8 Oct 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).
Which versions are affected by CVE-2020-15241?
23 open source packages ship an affected version, including typo3fluid/fluid, typo3 and typo3/cms. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
typo3fluid/fluid Packagist | From 2.0.0 | 2.0.5 |
typo3fluid/fluid Packagist | From 2.0.0 | 2.0.5 |
typo3fluid/fluid Packagist | From 2.1.0 | 2.1.4 |
typo3fluid/fluid Packagist | From 2.1.0 | 2.1.4 |
typo3fluid/fluid Packagist | From 2.2.0 | 2.2.1 |
typo3fluid/fluid Packagist | From 2.2.0 | 2.2.1 |
17 more packages
typo3fluid/fluid Packagist | From 2.3.0 | 2.3.5 |
typo3fluid/fluid Packagist | From 2.3.0 | 2.3.5 |
typo3fluid/fluid Packagist | From 2.4.0 | 2.4.1 |
typo3fluid/fluid Packagist | From 2.4.0 | 2.4.1 |
typo3fluid/fluid Packagist | From 2.5.0 | 2.5.5 |
typo3fluid/fluid Packagist | From 2.5.0 | 2.5.5 |
typo3fluid/fluid Packagist | From 2.6.0 | 2.6.1 |
typo3fluid/fluid Packagist | From 2.6.0 | 2.6.1 |
typo3 Bitnami | From 8.7.25 to 8.7.25 | None |
typo3/cms Packagist | From 8.0.0 | 8.7.25 |
typo3/cms Packagist | From 8.0.0 | 8.7.25 |
typo3/cms Packagist | From 9.0.0 | 9.5.6 |
typo3/cms Packagist | From 9.0.0 | 9.5.6 |
typo3/cms-core Packagist | From 8.0.0 | 8.7.25 |
typo3/cms-core Packagist | From 8.0.0 | 8.7.25 |
typo3/cms-core Packagist | From 9.0.0 | 9.5.6 |
typo3/cms-core Packagist | From 9.0.0 | 9.5.6 |
Products include Typo3 Fluid Engine, Typo3 Typo3.
How do I fix CVE-2020-15241?
Upgrade typo3fluid/fluid to a fixed version for your release line: 2.0.5, 2.1.4, 2.2.1 or 2.3.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-15241 being exploited?
There is no known exploitation of CVE-2020-15241 in the wild and no public exploit code.
Sources
Also known as BIT-typo3-2020-15241, GHSA-7733-hjv6-4h47.