Search for vulnerabilities
Vulnerability details: VCID-ynrh-kamk-augw
Vulnerability ID VCID-ynrh-kamk-augw
Aliases GHSA-4ppr-jw47-9qm5
Summary TYPO3 Cross-Site Scripting in Link Handling It has been discovered that t3:// URL handling and typolink functionality are vulnerable to cross-site scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering with typolink.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-4ppr-jw47-9qm5
cvssv3.1 6.1 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-12-17-2.yaml
generic_textual MODERATE https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-12-17-2.yaml
cvssv3.1 6.1 https://github.com/TYPO3-CMS/core
generic_textual MODERATE https://github.com/TYPO3-CMS/core
cvssv3.1 6.1 https://github.com/TYPO3-CMS/core/commit/280908c9472aa5e1d9ee005327bbb9aed53f613a
generic_textual MODERATE https://github.com/TYPO3-CMS/core/commit/280908c9472aa5e1d9ee005327bbb9aed53f613a
cvssv3.1 6.1 https://github.com/TYPO3-CMS/core/commit/89f5817c09a50d8d60821158d651bd618521164e
generic_textual MODERATE https://github.com/TYPO3-CMS/core/commit/89f5817c09a50d8d60821158d651bd618521164e
cvssv3.1 6.1 https://github.com/TYPO3-CMS/core/commit/d2823a451d65ac59dd42ec54c92903d70d29c813
generic_textual MODERATE https://github.com/TYPO3-CMS/core/commit/d2823a451d65ac59dd42ec54c92903d70d29c813
cvssv3.1 6.1 https://typo3.org/security/advisory/typo3-core-sa-2019-022
generic_textual MODERATE https://typo3.org/security/advisory/typo3-core-sa-2019-022
Reference id Reference type URL
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-12-17-2.yaml
https://github.com/TYPO3-CMS/core
https://github.com/TYPO3-CMS/core/commit/280908c9472aa5e1d9ee005327bbb9aed53f613a
https://github.com/TYPO3-CMS/core/commit/89f5817c09a50d8d60821158d651bd618521164e
https://github.com/TYPO3-CMS/core/commit/d2823a451d65ac59dd42ec54c92903d70d29c813
https://typo3.org/security/advisory/typo3-core-sa-2019-022
GHSA-4ppr-jw47-9qm5 https://github.com/advisories/GHSA-4ppr-jw47-9qm5
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-12-17-2.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/TYPO3-CMS/core
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/TYPO3-CMS/core/commit/280908c9472aa5e1d9ee005327bbb9aed53f613a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/TYPO3-CMS/core/commit/89f5817c09a50d8d60821158d651bd618521164e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/TYPO3-CMS/core/commit/d2823a451d65ac59dd42ec54c92903d70d29c813
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://typo3.org/security/advisory/typo3-core-sa-2019-022
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2025-07-01T12:11:26.103960+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-4ppr-jw47-9qm5/GHSA-4ppr-jw47-9qm5.json 36.1.3