Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
184 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Meta CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C CWE-352 CWE-346 Problem It has been discovered that backend user interface and install tool are vulnerable to same-origin request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server - scripts are then executed with the privileges of the victims' user session. In a worst case scenario new admin users can be created which can directly be used by an attacker. The vulnerability is basically a cross-site request forgery (CSRF) triggered by a cross-site scripting vulnerability (XSS) - but happens on the same target host - thus, it’s actually a same-origin request forgery. Malicious payload such as HTML containing JavaScript might be provided by either an authenticated backend user or by a non-authenticated user using a 3rd party extension - e.g. file upload in a contact form with knowing the target location. The attacked victim…
Recommended action: Upgrade to 10.4.2 or 9.5.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that backend user settings (in $BEUSER-uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of 3rd party components this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described. References https://typo3.org/security/advisory/typo3-core-sa-2020-005
Recommended action: Upgrade to 10.4.2 or 9.5.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Calling unserialize() on malicious user-submitted content can result in the following scenarios: - trigger deletion of arbitrary directory in file system (if writable for web server) - trigger message submission via email using identity of web site (mail relay) Another insecure deserialization vulnerability is required to actually exploit mentioned aspects. Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described. References https://typo3.org/security/advisory/typo3-core-sa-2020-004
Recommended action: Upgrade to 10.4.2 or 9.5.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting - properties being assigned as HTML attributes have not been parsed correctly. Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described. References https://typo3.org/security/advisory/typo3-core-sa-2020-003
Recommended action: Upgrade to 10.4.2 or 9.5.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placeholder attributes containing data of other database records are vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described. References https://typo3.org/security/advisory/typo3-core-sa-2020-002
Recommended action: Upgrade to 10.4.2 or 9.5.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In TYPO3 CMS 10.4.0 through 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2. References https://typo3.org/security/advisory/typo3-core-sa-2020-001
Recommended action: Upgrade to 10.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
Recommended action: Upgrade to 9.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. It was possible to execute XSS inside the CKEditor source area after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode. Although this is an unlikely scenario, it is recommended to upgrade to the latest editor version.
Recommended action: Upgrade to 9.5.2 or 8.7.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042.
Recommended action: Upgrade to 9.5.4 or 8.7.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.