GHSA-qffc-gwpp-m2xr: XML External Entity (XXE) Processing in TYPO3 Core

June 4, 2024

All XML processing within the TYPO3 CMS are vulnerable to XEE processing. This can lead to load internal and/or external (file) content within an XML structure. Furthermore it is possible to inject arbitrary files for an XML Denial of Service attack. For more information on that topic see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing.

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2016-02-23-1.yaml
github.com/advisories/GHSA-qffc-gwpp-m2xr
typo3.org/security/advisory/typo3-core-sa-2016-005

Code Behaviors & Features

Detect and mitigate GHSA-qffc-gwpp-m2xr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →