CVE-2012-3530

medium

Description

Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.

References

https://github.com/advisories/GHSA-94c2-g68f-9r98

https://exchange.xforce.ibmcloud.com/vulnerabilities/77794

http://www.openwall.com/lists/oss-security/2012/08/22/8

http://www.debian.org/security/2012/dsa-2537

http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/

http://secunia.com/advisories/50287

http://osvdb.org/84772

Details

Source: Mitre, NVD

Published: 2012-09-05

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.00573