TYPO3 cross-site scripting (XSS)
Low severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated Apr 25, 2024
Package
Affected versions
>= 6.0, < 6.2.15
>= 7.0, < 7.4.0
>= 4.0, <= 4.5.40
Patched versions
6.2.15
7.4.0
Description
Published by the National Vulnerability Database
Sep 16, 2015
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
Apr 25, 2024
Last updated
Apr 25, 2024
The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.
References