GHSA-mxjf-hc9v-xgv2 ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting
Attackers can exploit host header spoofing in TYPO3 to inject malicious scripts, potentially stealing user data or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-mxjf-hc9v-xgv2?
GHSA-mxjf-hc9v-xgv2 is a cross-site scripting vulnerability in typo3/cms, published on 30 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Which versions are affected by GHSA-mxjf-hc9v-xgv2?
8 open source packages ship an affected version, including typo3/cms.
| Package | Affected | Fixed in |
|---|---|---|
typo3/cms Packagist | From 4.5.0 | 4.5.34 |
typo3/cms Packagist | From 4.5.0 | 4.5.34 |
typo3/cms Packagist | From 4.7.0 | 4.7.19 |
typo3/cms Packagist | From 4.7.0 | 4.7.19 |
typo3/cms Packagist | From 6.1.0 | 6.1.9 |
typo3/cms Packagist | From 6.1.0 | 6.1.9 |
2 more packages
typo3/cms Packagist | From 6.2.0 | 6.2.3 |
typo3/cms Packagist | From 6.2.0 | 6.2.3 |
How do I fix GHSA-mxjf-hc9v-xgv2?
Upgrade typo3/cms to a fixed version for your release line: 4.5.34, 4.7.19, 6.1.9 or 6.2.3.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-mxjf-hc9v-xgv2 being exploited?
There is no known exploitation of GHSA-mxjf-hc9v-xgv2 in the wild and no public exploit code.