GHSA-qfr3-29w6-hwpg

Source

https://github.com/advisories/GHSA-qfr3-29w6-hwpg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qfr3-29w6-hwpg/GHSA-qfr3-29w6-hwpg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qfr3-29w6-hwpg

Aliases

CVE-2012-2112

Published

2022-05-17T01:46:40Z

Modified

2024-01-12T18:26:36.936187Z

Summary

Typo3 Exception Handler XSS

Details

Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.

Database specific

{
    "nvd_published_at": "2012-08-27T21:55:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-12T18:01:23Z"
}

References

Affected packages

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.4

Fixed

4.4.15

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.5

Fixed

4.5.15

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.6

Fixed

4.6.8

Packagist / typo3/cms

Package

Name: typo3/cms
Purl: pkg:composer/typo3/cms

Affected ranges

Affected versions

4.*

4.7