CVE-2020-26227
Cross-Site Scripting in Fluid view helpers
概要
Cross-Site Scripting in Fluid view helpers
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Meta
- CVSS:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.7)- CWE-79
Problem
It has been discovered that system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers.
Solution
Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.
Credits
Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 security team members Helmut Hummel & Oliver Hader who fixed the issue.
References
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Packagist
typo3/cms-core
[{"type":"ECOSYSTEM","events":[{"introduced":"8.7.0"},{"fixed":"8.7.38"}]}]
Packagist
typo3/cms
[{"type":"ECOSYSTEM","events":[{"introduced":"8.7.0"},{"fixed":"8.7.38"}]}]
参照URL
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com
- web packagist.org
- web typo3.org