Description
Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | typo3-src | 4.5.19+dfsg1-5+wheezy2 | DSA-2834-1 |
| Debian 6.0 | typo3-src | 4.3.9+dfsg1-1+squeeze9 | DSA-2834-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms | >= 4.5.0, < 4.5.32 | 4.5.32 | GHSA-r8m7-792j-5jvq |
| Packagist | typo3/cms | >= 4.7.0, < 4.7.17 | 4.7.17 | GHSA-r8m7-792j-5jvq |
| Packagist | typo3/cms | >= 6.0.0, < 6.0.12 | 6.0.12 | GHSA-r8m7-792j-5jvq |
| Packagist | typo3/cms | >= 6.1.0, < 6.1.7 | 6.1.7 | GHSA-r8m7-792j-5jvq |
Advisories 1
- DSA-2834-1 typo3-src - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20131212 Re: CVE request: TYPO3-CORE-SA-2013-004 and TYPO3-FLOW-SA-2013-001 mailing-list
- 64245 vdb-entry
- [oss-security] 20131211 CVE request: TYPO3-CORE-SA-2013-004 and TYPO3-FLOW-SA-2013-001 mailing-list
- contenteditingwizards-url-xss(89620) vdb-entry
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004
- DSA-2834 vendor-advisory
- 100881 vdb-entry