GHSA-mxjf-hc9v-xgv2 json
ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting
published 2y ago modified last yr.
- cvss
- 6.1
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Failing to properly validate the HTTP host-header TYPO3 CMS is susceptible to host spoofing. TYPO3 uses the HTTP host-header to generate absolute URLs in several places like 404 handling, http(s) enforcement, password reset links and many more. Since the host header itself is provided by the client it can be forged to any value, even in a name based virtual hosts environment. A blog post describes this problem in great detail.
Patch / fix
- packagist typo3/cms 4.5.34, 4.7.19, 6.1.9, 6.2.3
- github.com/TYPO3/typo3@32efb1b commit
- github.com/TYPO3/typo3@9bd7776 commit
- github.com/TYPO3/typo3@c39bca9 commit
- github.com/TYPO3/typo3@d554ac5 commit
Is GHSA-mxjf-hc9v-xgv2 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms | >=6.2.0, <6.2.3 >=6.1.0, <6.1.9 >=4.7.0, <4.7.19 >=4.5.0, <4.5.34 |
6.2.3 6.1.9 4.7.19 4.5.34 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/TYPO3/typo3/commit/32efb1b03573d51391126c90cd87c74b3dc457fb
web
-
github.com
/TYPO3/typo3/commit/9bd777649e4022c89dbf39ca41988a594b5e94b8
web
-
github.com
/TYPO3/typo3/commit/c39bca9613c311dd12e61771dd311b1bb2283b8d
web
-
github.com
/TYPO3/typo3/commit/d554ac5323f3b0fac1fce4c2c491d0123badd669
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2014-05-22-1.yaml
web
-
github.com
/TYPO3/typo3
package
-
typo3.org
/security/advisory/typo3-core-sa-2014-001
web
-
web.archive.org
/web/20140531042943/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001
web
Sources
- GitHub Advisory GHSA-mxjf-hc9v-xgv2
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.