Search for packages
| purl | pkg:composer/typo3/cms@9.5.6 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-dybf-xk32-pkdg
Aliases: CVE-2020-15241 GHSA-7733-hjv6-4h47 |
Cross-Site Scripting in ternary conditional operator > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C`(5.0) > * CWE-79 --- :information_source: This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020 --- ### Problem It has been discovered that the Fluid Engine (package `typo3fluid/fluid`) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following. ``` {showFullName ? fullName : defaultValue} ``` ### Solution Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this `typo3fluid/fluid` package that fix the problem described. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) releases: * TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.5) * TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1) ### Credits Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue. ### References * [TYPO3-CORE-SA-2019-013](https://typo3.org/security/advisory/typo3-core-sa-2019-013) |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-24z2-dffm-wfdf | Typo3 Security Misconfiguration in User Session Handling When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability. |
GHSA-g9rv-6g56-65h8
|
| VCID-2u1x-fkuh-7fbe | Typo3 Information Disclosure in User Authentication It has been discovered that login failures have been logged on the default stream with log level "warning" including plain-text user credentials. |
GHSA-m96r-7vqm-j95g
|
| VCID-7zyp-yza7-2udn | Security Misconfiguration in User Session Handling. |
2019-05-07-2
|
| VCID-8hs1-4esc-7qac | Information Disclosure in User Authentication. |
2019-05-07-5
|
| VCID-dkmy-bwds-s7f4 | Cross-site Scripting Cross-Site Scripting in Fluid Engine. |
2019-05-07-1
|
| VCID-dybf-xk32-pkdg | Cross-Site Scripting in ternary conditional operator > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C`(5.0) > * CWE-79 --- :information_source: This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020 --- ### Problem It has been discovered that the Fluid Engine (package `typo3fluid/fluid`) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following. ``` {showFullName ? fullName : defaultValue} ``` ### Solution Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this `typo3fluid/fluid` package that fix the problem described. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) releases: * TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.5) * TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1) ### Credits Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue. ### References * [TYPO3-CORE-SA-2019-013](https://typo3.org/security/advisory/typo3-core-sa-2019-013) |
CVE-2020-15241
GHSA-7733-hjv6-4h47 |
| VCID-f9e5-am8t-j7gc | TYPO3 Image Processing susceptible to Code Execution TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 is susceptible to remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick. For a successful exploit, the GhostScript binary `gs` must be available on the server system. |
CVE-2019-11832
GHSA-3w4h-r27h-4r2w |
| VCID-rep9-2rxn-gfee | Code Injection Possible Arbitrary Code Execution in Image Processing. |
2019-05-07-3
|
| VCID-s8xg-hd91-83br | Typo3 Information Disclosure in Page Tree It has been discovered backend users not having read access to specific pages still could see them in the page tree which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability. |
GHSA-h934-f4m4-wc8x
|
| VCID-yfgj-vux5-sybb | Information Disclosure in Page Tree. |
2019-05-07-4
|