CVE-2014-3943 Typo3 XSS Vulnerabilities
LowCVSS 3.5
EPSS 1.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via unknown parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typo3/cms(Packagist) | >= 4.5.0, < 4.5.34 | 4.5.34 |
| typo3/cms(Packagist) | >= 4.7.0, < 4.7.19 | 4.7.19 |
| typo3/cms(Packagist) | >= 6.0.0, < 6.0.14 | 6.0.14 |
| typo3/cms(Packagist) | >= 6.1.0, < 6.1.9 | 6.1.9 |
| typo3/cms(Packagist) | >= 6.2.0, < 6.2.3 | 6.2.3 |
| typo3/cms(Packagist) | = 6.2.0 | No fix listed |
| typo3/cms(Packagist) | = 6.2.1 | No fix listed |
| typo3/cms(Packagist) | = 6.2.2 | No fix listed |
| typo3 | = 4.5.0 | No fix listed |
| typo3 | = 4.5.1 | No fix listed |
| typo3 | = 4.5.2 | No fix listed |
| typo3 | = 4.5.3 | No fix listed |
| typo3 | = 4.5.4 | No fix listed |
| typo3 | = 4.5.5 | No fix listed |
| typo3 | = 4.5.6 | No fix listed |
| typo3 | = 4.5.7 | No fix listed |
| typo3 | = 4.5.8 | No fix listed |
| typo3 | = 4.5.9 | No fix listed |
| typo3 | = 4.5.10 | No fix listed |
| typo3 | = 4.5.11 | No fix listed |
| typo3 | = 4.5.12 | No fix listed |
| typo3 | = 4.5.13 | No fix listed |
| typo3 | = 4.5.14 | No fix listed |
| typo3 | = 4.5.15 | No fix listed |
| typo3 | = 4.5.16 | No fix listed |
Show 69 more
| Product | Affected versions | Fixed in |
|---|---|---|
| typo3 | = 4.5.17 | No fix listed |
| typo3 | = 4.5.18 | No fix listed |
| typo3 | = 4.5.19 | No fix listed |
| typo3 | = 4.5.20 | No fix listed |
| typo3 | = 4.5.21 | No fix listed |
| typo3 | = 4.5.22 | No fix listed |
| typo3 | = 4.5.23 | No fix listed |
| typo3 | = 4.5.24 | No fix listed |
| typo3 | = 4.5.25 | No fix listed |
| typo3 | = 4.5.26 | No fix listed |
| typo3 | = 4.5.27 | No fix listed |
| typo3 | = 4.5.28 | No fix listed |
| typo3 | = 4.5.29 | No fix listed |
| typo3 | = 4.5.30 | No fix listed |
| typo3 | = 4.5.31 | No fix listed |
| typo3 | = 4.5.32 | No fix listed |
| typo3 | = 4.5.33 | No fix listed |
| typo3 | = 6.0 | No fix listed |
| typo3 | = 6.0.1 | No fix listed |
| typo3 | = 6.0.2 | No fix listed |
| typo3 | = 6.0.3 | No fix listed |
| typo3 | = 6.0.4 | No fix listed |
| typo3 | = 6.0.5 | No fix listed |
| typo3 | = 6.0.6 | No fix listed |
| typo3 | = 6.0.7 | No fix listed |
| typo3 | = 6.0.8 | No fix listed |
| typo3 | = 6.0.9 | No fix listed |
| typo3 | = 6.0.10 | No fix listed |
| typo3 | = 6.0.11 | No fix listed |
| typo3 | = 6.0.12 | No fix listed |
| typo3 | = 6.0.13 | No fix listed |
| typo3 | = 6.2 | No fix listed |
| typo3 | = 6.2.0-beta1 | No fix listed |
| typo3 | = 6.2.0-beta2 | No fix listed |
| typo3 | = 6.2.0-beta3 | No fix listed |
| typo3 | = 6.2.1 | No fix listed |
| typo3 | = 6.2.2 | No fix listed |
| typo3 | = 6.1 | No fix listed |
| typo3 | = 6.1.1 | No fix listed |
| typo3 | = 6.1.2 | No fix listed |
| typo3 | = 6.1.3 | No fix listed |
| typo3 | = 6.1.4 | No fix listed |
| typo3 | = 6.1.5 | No fix listed |
| typo3 | = 6.1.6 | No fix listed |
| typo3 | = 6.1.7 | No fix listed |
| typo3 | = 6.1.8 | No fix listed |
| typo3 | = 4.7.0 | No fix listed |
| typo3 | = 4.7.1 | No fix listed |
| typo3 | = 4.7.2 | No fix listed |
| typo3 | = 4.7.3 | No fix listed |
| typo3 | = 4.7.4 | No fix listed |
| typo3 | = 4.7.5 | No fix listed |
| typo3 | = 4.7.6 | No fix listed |
| typo3 | = 4.7.7 | No fix listed |
| typo3 | = 4.7.8 | No fix listed |
| typo3 | = 4.7.9 | No fix listed |
| typo3 | = 4.7.10 | No fix listed |
| typo3 | = 4.7.11 | No fix listed |
| typo3 | = 4.7.12 | No fix listed |
| typo3 | = 4.7.13 | No fix listed |
| typo3 | = 4.7.14 | No fix listed |
| typo3 | = 4.7.15 | No fix listed |
| typo3 | = 4.7.16 | No fix listed |
| typo3 | = 4.7.17 | No fix listed |
| typo3 | = 4.7.18 | No fix listed |
| typo3/cms(Packagist) | >= 4.5.0, <= 4.5.33 | No fix listed |
| typo3/cms(Packagist) | >= 4.7.0, <= 4.7.18 | No fix listed |
| typo3/cms(Packagist) | >= 6.0.0, <= 6.0.13 | No fix listed |
| typo3/cms(Packagist) | >= 6.1.0, <= 6.1.8 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- typo3.org
- typo3.org
- web.archive.org
- openSUSE-SU-2014:0813 vendor-advisory
- DSA-2942 vendor-advisory
- [oss-security] 20140603 Re: CVE ID request: typo3 mailing-list
- typo3.org vendor-advisory
- 67625 vdb-entry
- github.com