GHSA-3mqf-fwc6-vwqw

Dashboard / Vulnerabilities / GHSA-3mqf-fwc6-vwqw

GHSA-3mqf-fwc6-vwqw

Published: 17 May 2022Last Modified: 8 Feb 2024

Aliases:

CVE-2010-5098

Summary: TYPO3 Cross-site scripting (XSS) vulnerability in the FORM content object

Details: Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

References: https://nvd.nist.gov/vuln/detail/CVE-2010-5098, https://github.com/TYPO3/typo3/commit/3c5d15233ca765fabeac21f0600d831595d31cd8, https://github.com/TYPO3/typo3/commit/4e8bd7a15681c0683196984e871f60f0646ea2b6, https://github.com/TYPO3/typo3/commit/6d17fe7cef30b09a65e0c2d54f8871ec3ddfc67e, https://exchange.xforce.ibmcloud.com/vulnerabilities/64179, https://github.com/TYPO3-CMS/frontend, https://web.archive.org/web/20101229020821/http://secunia.com/advisories/35770, https://web.archive.org/web/20111025222220/http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-022, https://web.archive.org/web/20111223211753/http://www.securityfocus.com/bid/45470, http://www.openwall.com/lists/oss-security/2011/01/13/2, http://www.openwall.com/lists/oss-security/2012/05/10/7, http://www.openwall.com/lists/oss-security/2012/05/11/3, http://www.openwall.com/lists/oss-security/2012/05/12/5

Affected packages

Package

Name: typo3/cms-frontend

Purl: pkg:composer/typo3/cms-frontend

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 4.2.0

Fixed -4.2.16

Affected versions

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High