GHSA-7733-hjv6-4h47MediumCVSS 4.7

Cross-Site Scripting in ternary conditional operator

Published
October 8, 2020
Last Modified
February 1, 2024

🔗 CVE IDs covered (1)

CVE-2020-15241 →

📋 Description

Meta

  • CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0)
  • CWE-79

:information_source:  This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020

Problem

It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.

{showFullName ? fullName : defaultValue}

Solution

Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described.

Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases:

  • TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.5)
  • TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1)

Credits

Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.

References

🎯 Affected products11

  • composer/typo3fluid/fluid:>= 2.0.0, < 2.0.5
  • composer/typo3fluid/fluid:>= 2.1.0, < 2.1.4
  • composer/typo3fluid/fluid:>= 2.2.0, < 2.2.1
  • composer/typo3fluid/fluid:>= 2.3.0, < 2.3.5
  • composer/typo3fluid/fluid:>= 2.4.0, < 2.4.1
  • composer/typo3fluid/fluid:>= 2.5.0, < 2.5.5
  • composer/typo3fluid/fluid:>= 2.6.0, < 2.6.1
  • composer/typo3/cms-core:>= 8.0.0, < 8.7.25
  • composer/typo3/cms-core:>= 9.0.0, < 9.5.6
  • composer/typo3/cms:>= 8.0.0, < 8.7.25
  • composer/typo3/cms:>= 9.0.0, < 9.5.6

🔗 References (8)