What is GHSA-2hp4-8h6h-93rr?

GHSA-2hp4-8h6h-93rr is a security advisory published by GitHub Security Advisories with Medium severity. Typo3 Backend History Module Vulnerable to XSS

Which CVE IDs does GHSA-2hp4-8h6h-93rr cover?

GHSA-2hp4-8h6h-93rr covers the following CVE IDs: CVE-2012-6146. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-2hp4-8h6h-93rr?

GHSA-2hp4-8h6h-93rr affects 3 products, including: composer/typo3/cms:\u003e= 4.5, \u003c 4.5.21; composer/typo3/cms:\u003e= 4.6, \u003c 4.6.14; composer/typo3/cms:\u003e= 4.7, \u003c 4.7.6.

GHSA-2hp4-8h6h-93rrMedium

Typo3 Backend History Module Vulnerable to XSS

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 12, 2024

🔗 CVE IDs covered (1)

CVE-2012-6146 →

📋 Description

The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL.

🎯 Affected products3

composer/typo3/cms:>= 4.5, < 4.5.21
composer/typo3/cms:>= 4.6, < 4.6.14
composer/typo3/cms:>= 4.7, < 4.7.6

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2012-6146
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/
https://github.com/advisories/GHSA-2hp4-8h6h-93rr