GHSA-h86g-796f-hhfq

Source

https://github.com/advisories/GHSA-h86g-796f-hhfq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-h86g-796f-hhfq/GHSA-h86g-796f-hhfq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h86g-796f-hhfq

Aliases

CVE-2011-4632

Published

2022-04-22T00:24:10Z

Modified

2024-01-12T20:56:34.881573Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Typo3 XSS Vulnerabilities

Details

Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message.

Database specific

{
    "nvd_published_at": "2019-11-06T17:15:00Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-12T20:42:44Z"
}

References

Affected packages

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.3.12

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-h86g-796f-hhfq/GHSA-h86g-796f-hhfq.json"

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.4.0

Fixed

4.4.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-h86g-796f-hhfq/GHSA-h86g-796f-hhfq.json"

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.5.0

Fixed

4.5.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-h86g-796f-hhfq/GHSA-h86g-796f-hhfq.json"