CVE-2020-26227
Medium
Description
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Typo3
PublishedNov 23, 2020
First seenNov 23, 2020
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- typo3 typo36.2.54, 7.6.48, 8.7.38, 9.5.23, 10.4.10 or later
- typo3/cms-core9.5.23, 10.4.10, 8.7.38 or later
- typo3/cms10.4.10, 9.5.23, 8.7.38 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typo3 typo3 | 6.2.0 ≤ v < 6.2.54, 7.6.0 ≤ v < 7.6.48, 8.7.0 ≤ v < 8.7.38, 9.0.0 ≤ v < 9.5.23, 10.0.0 ≤ v < 10.4.10 | 6.2.54, 7.6.48, 8.7.38, 9.5.23, 10.4.10 |
| typo3/cms-corePackagist | 9.0.0 ≤ v < 9.5.23, 10.0.0 ≤ v < 10.4.10, 8.7.0 ≤ v < 8.7.38 | 9.5.23, 10.4.10, 8.7.38 |
| typo3/cmsPackagist | 10.0.0 ≤ v < 10.4.10, 9.0.0 ≤ v < 9.5.23, 8.7.0 ≤ v < 8.7.38 | 10.4.10, 9.5.23, 8.7.38 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.