GHSA-qmmw-ch2q-j6xxLow

Typo3 Backend API XSS Vulnerability

Published
May 17, 2022
Last Modified
January 12, 2024

🔗 CVE IDs covered (1)

CVE-2012-6147 →

📋 Description

Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

🎯 Affected products3

  • composer/typo3/cms:>= 4.5.0, < 4.5.21
  • composer/typo3/cms:>= 4.6.0, < 4.6.14
  • composer/typo3/cms:>= 4.7.0, < 4.7.6

🔗 References (5)