Search for vulnerabilities
Vulnerability details: VCID-cpa8-x668-5qgb
Vulnerability ID VCID-cpa8-x668-5qgb
Aliases GHSA-x428-565f-8xj2
Summary TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API Backend API configuration using Page TSconfig is vulnerable to arbitrary code execution and cross-site scripting. TSconfig fields of page properties in backend forms can be used to inject malicious sequences. Field tsconfig_includes is vulnerable to directory traversal leading to same scenarios as having direct access to TSconfig settings. A valid backend user account having access to modify values for fields `pages.TSconfig` and `pages.tsconfig_includes` is needed in order to exploit this vulnerability.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-x428-565f-8xj2
cvssv3.1 8.8 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-06-25-4.yaml
generic_textual HIGH https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-06-25-4.yaml
cvssv3.1 8.8 https://github.com/TYPO3-CMS/core
generic_textual HIGH https://github.com/TYPO3-CMS/core
cvssv3.1 8.8 https://github.com/TYPO3-CMS/core/commit/3a99a0877de6ad9cb39ba73146292b90e13294db
generic_textual HIGH https://github.com/TYPO3-CMS/core/commit/3a99a0877de6ad9cb39ba73146292b90e13294db
cvssv3.1 8.8 https://github.com/TYPO3-CMS/core/commit/822e62ec267fbe3c70a26f1c4f73f47fc615c930
generic_textual HIGH https://github.com/TYPO3-CMS/core/commit/822e62ec267fbe3c70a26f1c4f73f47fc615c930
cvssv3.1 8.8 https://typo3.org/security/advisory/typo3-core-sa-2019-019
generic_textual HIGH https://typo3.org/security/advisory/typo3-core-sa-2019-019
Reference id Reference type URL
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-06-25-4.yaml
https://github.com/TYPO3-CMS/core
https://github.com/TYPO3-CMS/core/commit/3a99a0877de6ad9cb39ba73146292b90e13294db
https://github.com/TYPO3-CMS/core/commit/822e62ec267fbe3c70a26f1c4f73f47fc615c930
https://typo3.org/security/advisory/typo3-core-sa-2019-019
GHSA-x428-565f-8xj2 https://github.com/advisories/GHSA-x428-565f-8xj2
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-06-25-4.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/TYPO3-CMS/core
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/TYPO3-CMS/core/commit/3a99a0877de6ad9cb39ba73146292b90e13294db
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/TYPO3-CMS/core/commit/822e62ec267fbe3c70a26f1c4f73f47fc615c930
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://typo3.org/security/advisory/typo3-core-sa-2019-019
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2025-07-01T12:11:17.854001+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-x428-565f-8xj2/GHSA-x428-565f-8xj2.json 36.1.3