CVE-2020-15241
08.10.2020, 21:15
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).| Vendor | Product | Version |
|---|---|---|
| typo3 | fluid_engine | 𝑥 < 2.0.5 |
| typo3 | fluid_engine | 2.1.0 ≤ 𝑥 < 2.1.4 |
| typo3 | fluid_engine | 2.2.0 ≤ 𝑥 < 2.2.1 |
| typo3 | fluid_engine | 2.3.0 ≤ 𝑥 < 2.3.5 |
| typo3 | fluid_engine | 2.4.0 ≤ 𝑥 < 2.4.1 |
| typo3 | fluid_engine | 2.5.0 ≤ 𝑥 < 2.5.5 |
| typo3 | fluid_engine | 2.6.0 ≤ 𝑥 < 2.6.1 |
| typo3 | typo3 | 8.7.25 |
| typo3 | typo3 | 9.5.6 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
References