MediumGHSA-8c25-vj2w-p72j

TYPO3 Cross-Site Scripting in Frontend User Login

Published 30 May 2024 · Updated 5 Dec 2024

Affected packages

typo3/cms-coreComposer

Affected: >=8.0.0 <8.7.21
Fixed in: 8.7.21

Update to the fixed version for your release line, for example:composer require typo3/cms-core:^8.7.21

typo3/cms-coreComposer

Affected: >=9.0.0 <9.5.2
Fixed in: 9.5.2

Update to the fixed version for your release line, for example:composer require typo3/cms-core:^9.5.2

typo3/cms-coreComposer

Affected: >=7.1.0 <7.6.32
Fixed in: 7.6.32

Update to the fixed version for your release line, for example:composer require typo3/cms-core:^7.6.32

Details

Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile.

Template patterns that are affected are

###FEUSER_[fieldName]### using system extension felogin
for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)

Is GHSA-8c25-vj2w-p72j in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected typo3/cms-core, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.