Description
Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified parameters to unknown backend forms.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | typo3-src | 4.2.5-1+lenny4 | DSA-2098-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms-backend | >= 4.1.0, < 4.1.14 | 4.1.14 | GHSA-jr79-65xr-q7cx |
| Packagist | typo3/cms-backend | >= 4.2.0, < 4.2.13 | 4.2.13 | GHSA-jr79-65xr-q7cx |
| Packagist | typo3/cms-backend | >= 4.3.0, < 4.3.4 | 4.3.4 | GHSA-jr79-65xr-q7cx |
| Packagist | typo3/cms-backend | >= 4.4.0, < 4.4.1 | 4.4.1 | GHSA-jr79-65xr-q7cx |
Advisories 1
- DSA-2098-1 typo3-src - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://security-tracker.debian.org/tracker/CVE-2010-3659/
- [oss-security] 20140212 Re: Old CVE ids, public, but still mailing-list
- [oss-security] 20100928 CVE requests: POE::Component::IRC, Alien Arena, Babiloo, Typo3, abcm2ps, ModSecurity, Linux kernel mailing-list
- 42029 vdb-entry
- https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-012/