GHSA-5cmc-r23m-hvrr

TYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-7077

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	typo3/cms-core	>= 6.0, < 6.0.12	6.0.12
Packagist	typo3/cms-core	>= 6.1, < 6.1.7	6.1.7

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-7077 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/89626 web
https://github.com/TYPO3-CMS/core package
http://osvdb.org/100884 web
http://seclists.org/oss-sec/2013/q4/473 web
http://seclists.org/oss-sec/2013/q4/487 web
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004 web