Cross-Site Scripting in TYPO3 Fluid Engine
CVE-2020-15241

4.7MEDIUM

Key Information:

Vendor

Typo3

Status
Fluid
Vendor
CVE Published:
8 October 2020

What is CVE-2020-15241?

TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1).

Affected Version(s)

Fluid >= 2.0.0, < 2.0.5 < 2.0.0, 2.0.5

Fluid >= 2.1.0, < 2.1.4 < 2.1.0, 2.1.4

Fluid >= 2.2.0, < 2.2.1 < 2.2.0, 2.2.1

References

https://github.com/TYPO3/Fluid/security/advisories/GHSA-7...
x_refsource_CONFIRM
https://github.com/TYPO3/Fluid/commit/9ef6a8ffff2e812025f...
x_refsource_MISC
https://typo3.org/security/advisory/typo3-core-sa-2019-013
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.