CVE-2018-6905
08.04.2018, 17:29
The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.
| Vendor | Product | Version |
|---|---|---|
| typo3 | typo3 | 𝑥 < 8.7.11 |
| typo3 | typo3 | 9.0.0 ≤ 𝑥 < 9.1.0 |
𝑥
= Vulnerable software versions