Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

typo3fluid/fluid

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.0PackagistPublished

    Cross-Site Scripting through Fluid view helper arguments

    CVE-2020-26216 · GHSA-hpjm-3ww5-6cpf

    Affected
    • Packagist typo3fluid/fluid >= 2.0.0, < 2.0.8; >= 2.1.0, < 2.1.7; >= 2.2.0, < 2.2.4; >= 2.3.0, < 2.3.7; >= 2.4.0, < 2.4.4; >= 2.5.0, < 2.5.11; >= 2.6.0, < 2.6.10
    Fixed in
    2.2.42.3.72.5.112.1.72.0.82.4.42.6.10· Vendor fix available
    Issue
    Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.7) CWE-79 Problem Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS throug maliciously crafted additionalAttributes arrays by creating keys with attribute-closing quotes followed by HTML. When rendering such attributes, TagBuilder would not escape the keys. 2. ViewHelpers which used the CompileWithContentArgumentAndRenderStatic trait, and which declared escapeOutput = false, would receive the content argument in unescaped format. 3. Subclasses of AbstractConditionViewHelper would receive the then and else arguments in unescaped format. Solution Update to versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 or 2.6.10 of this typo3fluid/fluid package that fix the problem described. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases: TYPO3 v9.5.23 (using typo3fluid/fluid v2.6.10) TYPO3 v10.4.10 (using typo3fluid/fluid v2.6.10) The…

    Recommended action: Upgrade to 2.6.10, 2.5.11, 2.4.4 or 4 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 4.7PackagistPublished

    Cross-Site Scripting in ternary conditional operator

    CVE-2020-15241 · GHSA-7733-hjv6-4h47

    Affected
    • Packagist typo3fluid/fluid >= 2.0.0, < 2.0.5; >= 2.1.0, < 2.1.4; >= 2.2.0, < 2.2.1; >= 2.3.0, < 2.3.5; >= 2.4.0, < 2.4.1; >= 2.5.0, < 2.5.5; >= 2.6.0, < 2.6.1
    Fixed in
    2.4.12.5.52.3.52.0.52.6.12.1.42.2.1· Vendor fix available
    Issue
    Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0) CWE-79 --- :informationsource: &nbsp;This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020 --- Problem It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following. Solution Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.5) TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1) Credits Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue. References TYPO3-CORE-SA-2019-013

    Recommended action: Upgrade to 2.6.1, 2.5.5, 2.4.1 or 4 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →