GHSA-2rcw-9hrm-8q7q: TYPO3 Cross-Site Scripting in Frontend User Login
Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile.
Template patterns that are affected are
- ###FEUSER_[fieldName]### using system extension felogin
References
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-3.yaml
- github.com/TYPO3/typo3
- github.com/TYPO3/typo3/commit/1c85fe70269e2ff8ecf0b6d5f16550c6cd0ddc78
- github.com/TYPO3/typo3/commit/373bec5d7d415f0764ebbadc7970610dc26da068
- github.com/TYPO3/typo3/commit/e4143195e1451630f058a58ab62d92135948a927
- github.com/advisories/GHSA-2rcw-9hrm-8q7q
- typo3.org/security/advisory/typo3-core-sa-2018-008
Code Behaviors & Features
Detect and mitigate GHSA-2rcw-9hrm-8q7q with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →