TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe
    markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to
    versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in
    a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but
    might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of
    TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem. (CVE-2023-38500)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b1ac663f-3aa9-11ee-b887-b42e991fc52e advisory.

  - ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the     `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to     the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin`     plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-37905)

  - TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to     versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP     query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For     instance, this allowed visitors to access content of an internal site by adding handcrafted query     parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS,     11.5.30, 12.4.4 fix the problem. (CVE-2023-38499)

  - TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe     markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to     versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in     a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but     might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of     TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem. (CVE-2023-38500)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of TYPO3 installed on the remote host is prior to 8.7.42 < 8.7.53 ELTS / 9.5.29 < 9.5.42 ELTS / 10.4.19 < 10.4.39 ELTS / 11.3.2 < 11.5.30 / 12.0.0 < 12.4.4. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2023-002 advisory.

  - Due to an encoding issue in the serialization layer, malicious markup nested in a noscript element was not     encoded correctly. noscript is disabled in the default configuration, but might have been enabled in     custom scenarios. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer.
    (CVE-2023-38500)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
410737	SCA: security update for typo3/html-sanitizer (GHSA-59jf-3q9v-rh6g)	Tenable Cloud Security	SCA Checks	medium
410737	SCA: security update for typo3/html-sanitizer (GHSA-59jf-3q9v-rh6g)	Tenable Self-Hosted Container Security	SCA Checks	medium
179872	FreeBSD : typo3 -- multiple vulnerabilities (b1ac663f-3aa9-11ee-b887-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	medium
178776	TYPO3 8.7.42 < 8.7.53 ELTS / 9.5.29 < 9.5.42 ELTS / 10.4.19 < 10.4.39 ELTS / 11.3.2 < 11.5.30 / 12.0.0 < 12.4.4 XSS (TYPO3-CORE-SA-2023-002)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2023-38500

medium

Tenable Plugins

medium

medium

medium

medium