CVE-2020-11070
Medium
Description
The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. This is fixed in version 1.0.3.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Typo3 Svg Sanitizer
PublishedMay 13, 2020
First seenMay 13, 2020
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- typo3 svg_sanitizer1.0.3 or later
- t3g/svg-sanitizer1.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typo3 svg_sanitizer | v < 1.0.3 | 1.0.3 |
| t3g/svg-sanitizerPackagist | v < 1.0.3 | 1.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.