GHSA-fv2m-9249-qx85MediumCVSS 5.4

TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper

Published
September 16, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-36108 →

📋 Description

Meta

  • CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.1)

Problem

It has been discovered that the f:asset.css view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS.

Solution

Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem described above.

Credits

Thanks to TYPO3 contributor member Frank Nägler who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue.

References

🎯 Affected products4

  • composer/typo3/cms-core:>= 10.3.0, < 10.4.32
  • composer/typo3/cms-core:>= 11.0.0, < 11.5.16
  • composer/typo3/cms:>= 10.3.0, < 10.4.32
  • composer/typo3/cms:>= 11.0.0, < 11.5.16

🔗 References (8)