GHSA-wp8j-c736-c5r3 TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors
Editors can inject malicious scripts via typolink attributes or file renaming errors, potentially compromising frontend users or backend administrators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-wp8j-c736-c5r3?
GHSA-wp8j-c736-c5r3 is a cross-site scripting vulnerability in typo3/cms, published on 30 May 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
It has been discovered that link tags generated by typolink functionality in the website's frontend are vulnerable to cross-site scripting - values being assigned to HTML attributes have not been parsed correctly. A valid backend user account is needed to exploit this vulnerability.
As second and separate vulnerability in the filelist module of the backend user interface has been referenced with this advisory as well. Error messages being shown after using a malicious name for renaming a file are not propery encoded, thus vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability.
Which versions are affected by GHSA-wp8j-c736-c5r3?
4 open source packages ship an affected version, including typo3/cms.
| Package | Affected | Fixed in |
|---|---|---|
typo3/cms Packagist | From 6.2.0 | 6.2.14 |
typo3/cms Packagist | From 6.2.0 | 6.2.14 |
typo3/cms Packagist | From 7.0.0 | 7.3.1 |
typo3/cms Packagist | From 7.0.0 | 7.3.1 |
How do I fix GHSA-wp8j-c736-c5r3?
Upgrade typo3/cms to a fixed version for your release line: 6.2.14 or 7.3.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-wp8j-c736-c5r3 being exploited?
There is no known exploitation of GHSA-wp8j-c736-c5r3 in the wild and no public exploit code.