| Package | Affected versions | Patched versions |
|---|---|---|
| typo3/cms | ≥ 8.0.0, < 8.7.25≥ 9.0.0, < 9.5.6 | 8.7.259.5.6 |
| typo3/cms-core | ≥ 8.0.0, < 8.7.25≥ 9.0.0, < 9.5.6 | 8.7.259.5.6 |
| typo3fluid/fluid | ≥ 2.0.0, < 2.0.5≥ 2.1.0, < 2.1.4≥ 2.2.0, < 2.2.1≥ 2.3.0, < 2.3.5≥ 2.4.0, < 2.4.1≥ 2.5.0, < 2.5.5≥ 2.6.0, < 2.6.1 | 2.0.52.1.42.2.12.3.52.4.12.5.52.6.1 |
| fluid engine | ≥ 2.1.0, < 2.1.4≥ 2.2.0, < 2.2.1≥ 2.3.0, < 2.3.5≥ 2.4.0, < 2.4.1≥ 2.5.0, < 2.5.5≥ 2.6.0, < 2.6.1< 2.0.5 | 2.1.42.2.12.3.52.4.12.5.52.6.12.0.5 |
| typo3 | = 8.7.25= 9.5.6 |
Meta
- CVSS:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0)- CWE-79
:information_source: This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020
It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.
{showFullName ? fullName : defaultValue}
Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described.
Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases:
typo3fluid/fluid v2.5.5)typo3fluid/fluid v2.6.1)Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free