| Vulnerability Name: | CCN-56497 | ||||||
| Published: | 2010-02-23 | ||||||
| Updated: | 2010-02-23 | ||||||
| Summary: | TYPO3 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by various backend scripts. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. | ||||||
| CVSS v3 Severity: | 2.6 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N)
| ||||||
| CVSS v2 Severity: | 3.5 Low (CCN CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N) 3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||
| Vulnerability Consequences: | Gain Access | ||||||
| References: | Source: CCN Type: SA38668 TYPO3 Multiple Vulnerabilities Source: CCN Type: TYPO3-SA-2010-004 Multiple vulnerabilities in TYPO3 Core Source: DEBIAN Type: DSA-2008 typo3-src -- several vulnerabilities Source: CCN Type: BID-38366 TYPO3 Core Multiple Remote Security Vulnerabilities Source: XF Type: UNKNOWN typo3-multiple-xss(56497) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||