GHSA-6xwf-7rfm-4gwc: TYPO3 Cross-Site Scripting in Filelist Module

May 30, 2024

It has been discovered that the output table listing in the “Files” backend module is vulnerable to cross-site scripting when a file extension contains malicious sequences.

Access to the file system of the server - either directly or through synchronization - is required to exploit the vulnerability.

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-12-17-3.yaml
github.com/TYPO3-CMS/core
github.com/advisories/GHSA-6xwf-7rfm-4gwc
typo3.org/security/advisory/typo3-core-sa-2019-023

Code Behaviors & Features

Detect and mitigate GHSA-6xwf-7rfm-4gwc with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →