Commerce extension for TYPO3 vulnerable to Cross-site Scripting

BAJO 3.5CVE-2009-4963 · GHSA-rmc9-5546-5rrf · Published 28/07/2010 · updated 16/06/2026

En resumen

CVE-2009-4963 es una vulnerabilidad BAJO (CVSS 3.5) que afecta a commerceteam/commerce, commerce extension (typo3).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.83%, mayor que el 57.7% de las vulnerabilidades.
Solución: actualizar a 0.9.9 o posterior.

Package	Affected versions	Patched versions
commerceteam/commerce Packagist	`≥ 0.9.6, < 0.9.9`	`0.9.9`
commerce extension typo3	`= 0.8.32= 0.8.35= 0.9.0= 0.9.5= 0.9.6= 0.9.7≤ 0.9.8`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the Commerce extension before 0.9.9 for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

NVD description

Cross-site scripting (XSS) vulnerability in the Commerce extension before 0.9.9 for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free