Skip to content
OpenAdvisories
Medium WID-SEC-2023-1878 3 CVEs

TYPO3 Core: Mehrere Schwachstellen

Published Jul 24, 2023 · Updated Jul 25, 2023 · Revision 2 · de-DE

Vendor: TYPO3 Product: Core Product: Core < 11.5.30 Product: Core < 12.4.4 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder Informationen offenzulegen.

Product

TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 3

  • Medium 6.1
    CVE-2023-37905

    Cross-site Scripting (XSS) in Source Mode of Editor in ckeditor-wordcount-plugin

    ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addr…

    TYPO3 w8tcha CKEditor-WordCount-Plugin cms-rte-ckeditor npm
  • Medium 4.7
    CVE-2023-38500

    By-passing Cross-Site Scripting Protection in HTML Sanitizer

    TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in…

    TYPO3 HTML Sanitizer typo3/html-sanitizer Packagist
  • Low 3.7
    CVE-2023-38499

    typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution

    TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope a…

    TYPO3 typo3 typo3/cms-core Web / CMS Packagist

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References