CVE-2020-11065
Last modified
CVE-2020-11065 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.. EPSS estimates a 0.54% chance of exploitation in the next 30 days.
Description
In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Typo3 | Typo3 | >= 9.5.12, < 9.5.17 |
| Typo3 | Typo3 | >= 10.2.0, < 10.4.2 |
References
- https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4j77-gg36-9864Third Party Advisory
- https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4j77-gg36-9864Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-11065?
How severe is CVE-2020-11065?
How do I fix CVE-2020-11065?
Are you affected by CVE-2020-11065?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST