VulnerableCode Package Details - pkg:composer/typo3/cms@7.3.0

Vulnerabilities affecting this package (57)

Advisory	Summary	Fixed in package version
GHSA-c5c9-8c6m-727v Aliases: CVE-2021-32768	Cross-Site Scripting via Rich-Text Content > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7) ### Problem Failing to properly parse, sanitize …	There are no reported fixed by versions.
GHSA-989h-wv8x-933p Aliases: CVE-2015-5956	TYPO3 cross-site scripting (XSS) The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote …	7.4.0 Vulnerable
GHSA-j6c3-3c4w-qv8p Aliases: CVE-2013-7341	Moodle cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through …	7.3.1 Vulnerable
GHSA-ppgf-8745-8pgx	Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS Phar files (formerly known as "PHP archives") can act als self …	7.6.30 Vulnerable
GHSA-f3wf-q4fj-3gxf	TYPO3 Denial of Service in Online Media Asset Handling Online Media Asset Handling (`.youtube` and `.vimeo` files) in the TYPO3 …	7.6.32 Vulnerable
GHSA-g585-crjf-vhwq	TYPO3 Denial of Service in Frontend Record Registration TYPO3’s built-in record registration functionality (aka `basic shopping cart`) using recs URL …	7.6.32 Vulnerable
GHSA-f777-f784-36gm	TYPO3 Security Misconfiguration in Install Tool Cookie It has been discovered that cookies created in the Install Tool are not …	7.6.32 Vulnerable
GHSA-7q33-hxwj-7p8v	TYPO3 Cross-Site Scripting in Backend Modal Component Failing to properly encode user input, notifications shown in modal windows in the …	7.6.32 Vulnerable
GHSA-6487-3qvg-8px9	TYPO3 Information Disclosure in Install Tool The Install Tool exposes the current TYPO3 version number to non-authenticated users.	7.6.32 Vulnerable
GHSA-6fc6-cj2j-h22x	TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend Failing to properly encode editor input, several frontend components are susceptible to Cross-Site …	7.6.1 Vulnerable
GHSA-5cxf-xx9j-54jc	Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend Failing to properly encode user input, several backend components are susceptible to Cross-Site …	7.6.1 Vulnerable
GHSA-6f9m-v7mp-7jjq	Authentication Bypass in TYPO3 CMS It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system …	7.6.30 Vulnerable
GHSA-2rcw-9hrm-8q7q	TYPO3 Cross-Site Scripting in Frontend User Login Failing to properly encode user input, login status display is vulnerable to cross-site …	7.6.32 Vulnerable
GHSA-8m6j-p5jv-v69w	TYPO3 Cross-Site Scripting in Online Media Asset Rendering Failing to properly encode user input, online media asset rendering (`*.youtube` and …	7.6.32 Vulnerable
GHSA-75mx-chcf-2q32	Duplicate Advisory: TYPO3 Cross-Site Scripting vulnerability in typolinks ## Duplicate Advisory This advisory has been withdrawn because it is a …	7.6.1 Vulnerable
GHSA-4r76-xr68-w7m7	TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts It has been …	7.3.1 Vulnerable
GHSA-r9vc-jfmh-6j48	TYPO3 frontend login vulnerable to Session Fixation It has been discovered that TYPO3 is susceptible to session fixation. If a …	7.3.1 Vulnerable
GHSA-r287-hc8j-w56h	TYPO3 Information Disclosure Vulnerability Exploitable by Editors It has been discovered, that editors with access to the file list module …	7.3.1 Vulnerable
GHSA-wp8j-c736-c5r3	TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors It has been discovered that link tags generated by typolink functionality in the …	7.3.1 Vulnerable
GHSA-pqfv-97hj-g97g	TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure It has been discovered, that calling a PHP script which is delivered with …	7.4.0 Vulnerable
GHSA-jqr8-q455-xx45	TYPO3 Brute Force Protection Bypass in backend login The backend login has a basic brute force protection implementation which pauses …	7.3.1 Vulnerable
CVE-2021-32767 Aliases: GHSA-34fr-fhqr-7235	Inclusion of Sensitive Information in Log Files TYPO3 is an open source PHP based web content management system. User credentials …	10.4.18 Vulnerable 11.3.1 Vulnerable 9.5.28 Vulnerable
TYPO3-CORE-SA-2015-012	Cross-Site Scripting vulnerability in typolinks All link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized editors …	6.2.16 Vulnerable 7.6.1 Vulnerable
GMS-2015-89	Cross-site Scripting Multiple Cross-Site Scripting vulnerabilities in frontend.	6.2.16 Vulnerable 7.6.1 Vulnerable
GMS-2018-98	Cross-site Scripting Cross-Site Scripting in Backend Modal Component.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
TYPO3-CORE-SA-2015-011	Multiple Cross-Site Scripting vulnerabilities in backend Failing to properly encode user input, several backend components are susceptible to Cross-Site Scripting, …	6.2.16 Vulnerable 7.6.1 Vulnerable
GMS-2018-102	Uncontrolled Resource Consumption Denial of Service in Online Media Asset Handling.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
GMS-2015-25	Unauthenticated Path Disclosure It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, …	6.2.15 Vulnerable 7.4.0 Vulnerable
GMS-2015-87	Cross-site Scripting Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend.	6.2.16 Vulnerable 7.6.1 Vulnerable
TYPO3-CORE-SA-2016-021	Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with …	8.3.1 Vulnerable 7.6.11 Vulnerable 6.2.27 Vulnerable
CVE-2015-5956	Cross-Site Scripting Vulnerability It has been discovered, that it is possible to forge a link to a backend module, which …	6.2.15 Vulnerable 7.4.0 Vulnerable
GMS-2018-99	Cross-site Scripting Cross-Site Scripting in Frontend User Login.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
TYPO3-CORE-SA-2016-013	Missing Access Check Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes …	8.1.1 Vulnerable 7.6.8 Vulnerable 6.2.24 Vulnerable
CVE-2019-19849	Deserialization of Untrusted Data It has been discovered that the classes `QueryGenerator` and `QueryView` are vulnerable to insecure deserialization. One …	8.7.30 Vulnerable 9.5.12 Vulnerable 10.2.2 Vulnerable
CVE-2021-32768 Aliases: GHSA-c5c9-8c6m-727v	Cross-site Scripting TYPO3 is an open source PHP based web content management system released under the GNU GPL. sanitize and …	10.4.19 Vulnerable 11.3.2 Vulnerable 9.5.29 Vulnerable
GMS-2018-103	Uncontrolled Resource Consumption Denial of Service in Frontend Record Registration.	8.7.21 Vulnerable 7.6.32 Vulnerable
GMS-2018-93	Improper Authentication Authentication Bypass in TYPO3 CMS.	9.3.2 Vulnerable 8.7.17 Vulnerable 7.6.30 Vulnerable
GMS-2018-97	Cross-site Scripting Cross-Site Scripting in Online Media Asset Rendering.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
CVE-2018-6905	Cross-site Scripting The page module in TYPO3 is vulnerable to XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a …	9.1.0 Vulnerable 8.7.11 Vulnerable
TYPO3-CORE-SA-2015-013	Multiple Cross-Site Scripting vulnerabilities in frontend Failing to properly encode editor input, several frontend components are susceptible to Cross-Site Scripting, …	6.2.16 Vulnerable 7.6.1 Vulnerable
GMS-2018-94	Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS.	9.3.2 Vulnerable 8.7.17 Vulnerable 7.6.30 Vulnerable
CVE-2021-21338 Aliases: GHSA-4jhw-2p6j-5wmp	URL Redirection to Untrusted Site (Open Redirect) Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
GMS-2015-88	Cross-site Scripting Cross-Site Scripting vulnerability in typolinks.	6.2.16 Vulnerable 7.6.1 Vulnerable
TYPO3-CORE-SA-2016-022	Cache Flooding in Frontend Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash …	8.3.1 Vulnerable 7.6.11 Vulnerable 6.2.27 Vulnerable
GMS-2018-101	Information Disclosure in Install Tool.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
CVE-2021-21370 Aliases: GHSA-x7hc-x7fm-f7qh	Cross-site Scripting Content elements of type `_menu_` are vulnerable to cross-site scripting when their referenced items get previewed in the …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
CVE-2019-19848	Path Traversal It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to …	8.7.30 Vulnerable 9.5.12 Vulnerable 10.2.2 Vulnerable
GMS-2018-100	Security Misconfiguration in Install Tool Cookie.	8.7.21 Vulnerable 9.5.2 Vulnerable 7.6.32 Vulnerable
CVE-2021-21339 Aliases: GHSA-qx3w-4864-94ch	Cleartext Storage of Sensitive Information User session identifiers are stored in cleartext - without processing of additional cryptographic hashing algorithms. …	10.4.14 Vulnerable 11.1.1 Vulnerable 9.5.25 Vulnerable
GHSA-56f9-5563-m2h7 Aliases: CVE-2015-8755	Typo3 XSS Vulnerability Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before …	7.6.1 Vulnerable 7.6.1 Vulnerable
GHSA-j5v7-9xr5-m7gx Aliases: CVE-2015-8759	TYPO3 Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before …	7.6.1 Vulnerable 7.6.1 Vulnerable
GHSA-3w22-wrwx-2r75 Aliases: CVE-2018-6905	Typo3 XSS Vulnerability The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering …	9.2.0 Vulnerable 9.2.0 Vulnerable
CVE-2022-23501 Aliases: GHSA-jfp7-79g7-89rf	TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and …	10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable 10.4.33 Vulnerable 11.5.20 Vulnerable 12.1.1 Vulnerable
CVE-2022-36107 Aliases: GHSA-9c6w-55cp-5w25	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is an open source PHP based web content management …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
CVE-2022-31047 Aliases: GHSA-fh99-4pgr-8j99	Insertion of Sensitive Information into Log File TYPO3 is an open source web content management system. Prior to versions 7.6.57 …	10.4.29 Vulnerable 11.5.11 Vulnerable 10.4.29 Vulnerable 11.5.11 Vulnerable
CVE-2022-36105 Aliases: GHSA-m392-235j-9r7r	Observable Discrepancy TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has …	10.4.32 Vulnerable 11.5.16 Vulnerable 10.4.32 Vulnerable 11.5.16 Vulnerable
GHSA-jg55-3q6h-2ccf Aliases: CVE-2009-0816	Typo3 Backend XSS Vulnerability An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	4.0

Advisory	Summary	Aliases
GMS-2015-84	Improper Restriction of Excessive Authentication Attempts Brute Force Protection Bypass in backend login.
GMS-2015-80	Improper Access Control Access bypass when editing file metadata.
GMS-2015-81	Frontend login Session Fixation.
GMS-2015-83	Information Disclosure possibility exploitable by Editors.
GMS-2015-85	Cross-site Scripting Cross-Site Scripting in 3rd party library Flowplayer.
GMS-2015-86	Information Exposure Frontend: Unauthenticated Path Disclosure.
GMS-2015-82	Cross-site Scripting Cross-Site Scripting exploitable by Editors.