Description
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | typo3-src | 4.3.9+dfsg1-1+squeeze5 | DSA-2537-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms | >= 4.5, < 4.5.19 | 4.5.19 | GHSA-94c2-g68f-9r98 |
| Packagist | typo3/cms | >= 4.6, < 4.6.12 | 4.6.12 | GHSA-94c2-g68f-9r98 |
| Packagist | typo3/cms | >= 4.7, < 4.7.4 | 4.7.4 | GHSA-94c2-g68f-9r98 |
Advisories 1
- DSA-2537-1 typo3-src - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/
- typo3-html5-xss(77794) vdb-entry
- DSA-2537 vendor-advisory
- [oss-security] 20120822 Re: CVE request: Typo3 mailing-list
- 84772 vdb-entry
- 50287 third-party-advisory