| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| typo3/cms | ≥ 8.0.0, < 8.7.25≥ 9.0.0, < 9.5.6 | 8.7.259.5.6 |
| typo3/cms-core | ≥ 8.0.0, < 8.7.25≥ 9.0.0, < 9.5.6 | 8.7.259.5.6 |
| typo3fluid/fluid | ≥ 2.0.0, < 2.0.5≥ 2.1.0, < 2.1.4≥ 2.2.0, < 2.2.1≥ 2.3.0, < 2.3.5≥ 2.4.0, < 2.4.1≥ 2.5.0, < 2.5.5≥ 2.6.0, < 2.6.1 | 2.0.52.1.42.2.12.3.52.4.12.5.52.6.1 |
| fluid engine | ≥ 2.1.0, < 2.1.4≥ 2.2.0, < 2.2.1≥ 2.3.0, < 2.3.5≥ 2.4.0, < 2.4.1≥ 2.5.0, < 2.5.5≥ 2.6.0, < 2.6.1< 2.0.5 | 2.1.42.2.12.3.52.4.12.5.52.6.12.0.5 |
| typo3 | = 8.7.25= 9.5.6 |
Meta
- CVSS:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0)- CWE-79
:information_source: This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020
It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.
{showFullName ? fullName : defaultValue}
Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described.
Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases:
typo3fluid/fluid v2.5.5)typo3fluid/fluid v2.6.1)Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン