CVE-2020-26216
Last modified
CVE-2020-26216 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. EPSS estimates a 1.03% chance of exploitation in the next 30 days.
Description
TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with attribute-closing quotes followed by HTML. When rendering such attributes, TagBuilder would not escape the keys. 2. ViewHelpers which used the CompileWithContentArgumentAndRenderStatic trait, and which declared escapeOutput = false, would receive the content argument in unescaped format. 3. Subclasses of AbstractConditionViewHelper would receive the then and else arguments in unescaped format. Update to versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 or 2.6.10 of this typo3fluid/fluid package that fix the problem described. More details are available in the linked advisory.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Typo3 | Fluid | < 2.0.8 |
| Typo3 | Fluid | >= 2.1.0, < 2.1.7 |
| Typo3 | Fluid | >= 2.2.0, < 2.2.4 |
| Typo3 | Fluid | >= 2.3.0, < 2.3.7 |
| Typo3 | Fluid | >= 2.4.0, < 2.4.4 |
| Typo3 | Fluid | >= 2.5.0, < 2.5.11 |
| Typo3 | Fluid | >= 2.6.0, < 2.6.10 |
References
- https://github.com/TYPO3/Fluid/commit/f20db4e74cf9803c6cffca2ed2f03e1b0b89d0dcPatch, Third Party Advisory
- https://github.com/TYPO3/Fluid/security/advisories/GHSA-hpjm-3ww5-6cpfExploit, Third Party Advisory
- https://typo3.org/security/advisory/typo3-core-sa-2020-009Exploit, Vendor Advisory
- https://github.com/TYPO3/Fluid/commit/f20db4e74cf9803c6cffca2ed2f03e1b0b89d0dcPatch, Third Party Advisory
- https://github.com/TYPO3/Fluid/security/advisories/GHSA-hpjm-3ww5-6cpfExploit, Third Party Advisory
- https://typo3.org/security/advisory/typo3-core-sa-2020-009Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-26216?
How severe is CVE-2020-26216?
How do I fix CVE-2020-26216?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-26210In BookStack before version 0.30.4, a user with permissions …8.7
- CVE-2020-26211In BookStack before version 0.30.4, a user with permissions …8.7
- CVE-2020-26212GLPI stands for Gestionnaire Libre de Parc Informatique and …6.5
- CVE-2020-26213In teler before version 0.0.1, if you run teler inside a Doc…7.5
- CVE-2020-26214In Alerta before version 8.1.0, users may be able to bypass …9.8
- CVE-2020-26215Jupyter Notebook before version 6.1.5 has an Open redirect v…6.1
- CVE-2020-26217XStream before version 1.4.14 is vulnerable to Remote Code E…8.8
- CVE-2020-26218touchbase.ai before version 2.0 is vulnerable to Cross-Site …6.1
- CVE-2020-26219touchbase.ai before version 2.0 is vulnerable to Open Redire…6.1
- CVE-2020-2622Vulnerability in the Enterprise Manager Base Platform produc…6
- CVE-2020-26220toucbase.ai before version 2.0 leaks information by not stri…3.5
- CVE-2020-26221touchbase.ai before version 2.0 is vulnerable to Cross-Site …6.1
Are you affected by CVE-2020-26216?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST