GHSA-8m6j-p5jv-v69w: TYPO3 Cross-Site Scripting in Online Media Asset Rendering
Failing to properly encode user input, online media asset rendering (*.youtube and *.vimeo files) is vulnerable to cross-site scripting. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-1.yaml
- github.com/TYPO3/typo3
- github.com/TYPO3/typo3/commit/20927adfb8aae0093508c904937e40114b92a90c
- github.com/TYPO3/typo3/commit/a32a9a746f807b14571139f0cb7caa00b8d037a5
- github.com/TYPO3/typo3/commit/c9174937802581bfecfaa788512a4f6e5cf8e9c7
- github.com/advisories/GHSA-8m6j-p5jv-v69w
- typo3.org/security/advisory/typo3-core-sa-2018-006
Code Behaviors & Features
Detect and mitigate GHSA-8m6j-p5jv-v69w with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →