Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x
    before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML
    via exception messages. (CVE-2012-2112)

Helmut Hummel of the TYPO3 security team discovered that TYPO3, a web content management system, is not properly sanitizing output of the exception handler. This allows an attacker to conduct cross-site scripting attacks if either third-party extensions are installed that do not sanitize this output on their own or in the presence of extensions using the extbase MVC framework which accept objects to controller actions.

Typo Security Team reports :

Failing to properly encode the output, the default TYPO3 Exception Handler is susceptible to Cross-Site Scripting. We are not aware of a possibility to exploit this vulnerability without third party extensions being installed that put user input in exception messages.
However, it has come to our attention that extensions using the extbase MVC framework can be used to exploit this vulnerability if these extensions accept objects in controller actions.

ID	Name	Product	Family	Severity
432592	SCA: security update for typo3/cms (GHSA-qfr3-29w6-hwpg)	Tenable Cloud Security	SCA Checks	medium
432592	SCA: security update for typo3/cms (GHSA-qfr3-29w6-hwpg)	Tenable Self-Hosted Container Security	SCA Checks	medium
58817	Debian DSA-2455-1 : typo3-src - missing input sanitization	Nessus	Debian Local Security Checks	medium
58790	FreeBSD : typo -- XSS (67516177-88ec-11e1-9a10-0023ae8e59f0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-2112

medium

Tenable Plugins

medium

medium

medium

medium