GHSA-8648-h559-8h42

    Dashboard / Vulnerabilities / GHSA-8648-h559-8h42

    GHSA-8648-h559-8h42

    Published: 27 Mar 2023Last Modified: 29 Oct 2024

    Summary: Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting

    Details: All versions of Fluid Components before 3.5.0 were susceptible to Cross-Site Scripting. Version 3.5.0 of the extension fixes this issue. Due to the nature of the problem, some changes in your project's Fluid templates might be necessary to prevent unwanted double-escaping of HTML markup.

    References: https://nvd.nist.gov/vuln/detail/CVE-2023-28604, https://github.com/FriendsOfPHP/security-advisories/blob/master/sitegeist/fluid-components/CVE-2023-28604.yaml, https://github.com/sitegeist/fluid-components, https://github.com/sitegeist/fluid-components/blob/master/Documentation/XssIssue.md, https://typo3.org/security/advisory/typo3-ext-sa-2023-003

    Affected packages

    Package

    Name: sitegeist/fluid-components

    Purl: pkg:composer/sitegeist/fluid-components

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.5.0

    Affected versions

    1.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-8648-h559-8h42 | CVE-DB