GHSA-7q33-hxwj-7p8v: TYPO3 Cross-Site Scripting in Backend Modal Component
Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-2.yaml
- github.com/TYPO3/typo3
- github.com/TYPO3/typo3/commit/02cd5c97228cba477d16c68e28309ce25c433ce9
- github.com/TYPO3/typo3/commit/89a38ad0ef9411745954f53f29bea5b8ce81cd32
- github.com/TYPO3/typo3/commit/c35646c3f7795a4a7b0046a88f146b490fa4883c
- github.com/advisories/GHSA-7q33-hxwj-7p8v
- typo3.org/security/advisory/typo3-core-sa-2018-007
Code Behaviors & Features
Detect and mitigate GHSA-7q33-hxwj-7p8v with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →