CVE-2023-47125

Summary

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected Software

Weaknesses

• CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-mm79-jhqm-9j54
• https://github.com/TYPO3/html-sanitizer/commit/b8f90717251d968c49dc77f8c1e5912e2fbe0dff
• https://typo3.org/security/advisory/typo3-core-sa-2023-007

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-mm79-jhqm-9j54
• https://github.com/TYPO3/html-sanitizer/commit/b8f90717251d968c49dc77f8c1e5912e2fbe0dff
• https://typo3.org/security/advisory/typo3-core-sa-2023-007

• ←Previous
• Next→