CVE-2021-32669
Cross-Site Scripting in Backend Grid View
概要
Cross-Site Scripting in Backend Grid View
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Problem
Failing to properly encode settings for backend layouts, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability.
Solution
Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.
Credits
Thanks to TYPO3 core merger Oliver Bartsch who reported and fixed the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Packagist
typo3/cms-core
[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.3.1"}]}]
Packagist
typo3/cms
[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.5.28"}]}]
参照URL
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com
- web typo3.org