| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| typo3/cms | ≥ 8.0.0, < 8.7.25≥ 9.0.0, < 9.5.6 | 8.7.259.5.6 |
| typo3/cms-core | ≥ 8.0.0, < 8.7.25≥ 9.0.0, < 9.5.6 | 8.7.259.5.6 |
| typo3fluid/fluid | ≥ 2.0.0, < 2.0.5≥ 2.1.0, < 2.1.4≥ 2.2.0, < 2.2.1≥ 2.3.0, < 2.3.5≥ 2.4.0, < 2.4.1≥ 2.5.0, < 2.5.5≥ 2.6.0, < 2.6.1 | 2.0.52.1.42.2.12.3.52.4.12.5.52.6.1 |
| fluid engine | ≥ 2.1.0, < 2.1.4≥ 2.2.0, < 2.2.1≥ 2.3.0, < 2.3.5≥ 2.4.0, < 2.4.1≥ 2.5.0, < 2.5.5≥ 2.6.0, < 2.6.1< 2.0.5 | 2.1.42.2.12.3.52.4.12.5.52.6.12.0.5 |
| typo3 | = 8.7.25= 9.5.6 |
Meta
- CVSS:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0)- CWE-79
:information_source: This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020
It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.
{showFullName ? fullName : defaultValue}
Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described.
Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases:
typo3fluid/fluid v2.5.5)typo3fluid/fluid v2.6.1)Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí