Zum Inhalt springen

Security update for TYPO3 versions 8 to 12

The TYPO3 Security Team has released new TYPO3 versions today. These close three security gaps.

TYPO3-CORE-SA-2023-002:
By-passing Cross-Site Scripting Protection in HTML Sanitizer

Affected component: HTML Sanitizer (HTML code cleanup)
Type of vulnerability: Cross-site scripting
Severity: medium
Affected TYPO3 versions: 8.7.42-8.7.52, 9.5.29-9.5.41, 10.4.19-10.4.38, 11.3.2-11.5.29, 12.0.0-12.4.3

Details: Due to an error in the serialization of data, malicious code within a noscript element is not coded correctly. noscript is disabled by default, but may have been enabled by the website maintainer/creator in certain cases.

TYPO3-CORE-SA-2023-003:
Information Disclosure due to Out-of-scope Site Resolution

Affected component: TYPO3 CMS
Type of vulnerability: Unintended disclosure of information
Severity: low
Affected TYPO3 versions: 9.4.0-9.5.41, 10.0.0-10.4.38, 11.0.0-11.5.29, 12.0.0-12.4.3

Details: In TYPO3 installations with multiple websites, it may be possible to access internal pages by manipulating the id and L parameters.

TYPO3-CORE-SA-2023-004:
Cross-Site Scripting in CKEditor4 WordCount Plugin

Affected component: Rich text editor CKEditor 4 (extension rte_ckeditor)
Type of vulnerability: Cross-site scripting
Severity: medium
Affected TYPO3 versions: 9.5.0-9.5.41, 10.0.0-10.4.38, 11.0.0-11.5.29

Details: The WordCount plugin for CKEditor 4 is vulnerable to cross-site scripting when switching to the source code view. The plugin is only active in the Full.yaml configuration, but not in the Default.yaml configuration. The vulnerability can usually only be exploited by a logged-in editor, unless the option to enter rich text is offered on the website.

Security update for TYPO3

This page contains automatically translated content.