Описание
Cross-Site Scripting in Page Preview
Meta
- CVSS:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC(5.0)
Problem
Failing to properly encode Page TSconfig settings, corresponding page preview module (Web>View) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability.
Solution
Update to TYPO3 versions 9.5.28, 10.4.18, 11.3.1 that fix the problem described.
Credits
Thanks to TYPO3 core merger Oliver Bartsch who reported and fixed the issue.
References
Ссылки
- https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-8mq9-fqv8-59wf
- https://github.com/TYPO3/typo3/security/advisories/GHSA-8mq9-fqv8-59wf
- https://nvd.nist.gov/vuln/detail/CVE-2021-32667
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-32667.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-32667.yaml
- https://typo3.org/security/advisory/typo3-core-sa-2021-009
Пакеты
typo3/cms-core
>= 9.0.0, < 9.5.28
9.5.28
typo3/cms-core
>= 10.0.0, < 10.4.18
10.4.18
typo3/cms-core
>= 11.0.0, < 11.3.1
11.3.1
typo3/cms
>= 10.0.0, < 10.4.18
10.4.18
typo3/cms
>= 11.0.0, < 11.3.1
11.3.1
typo3/cms
>= 9.0.0, < 9.5.28
9.5.28
Связанные уязвимости
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded, corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
Уязвимость реализации конфигурации Page TSconfig системы управления контентом TYPO3, позволяющая нарушителю осуществлять межсайтовые сценарные атаки