SB2018122804 - Multiple vulnerabilities in TYPO3

Main Vulnerability Database SB2018122804

SB2018122804 - Multiple vulnerabilities in TYPO3

Published: December 28, 2018

Security Bulletin ID SB2018122804

Severity

Low

Patch available

YES

Number of vulnerabilities 9

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 9 secuirty vulnerabilities.

1) Cross-site scripting (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in the Enhanced Image (image2) plugin due to insufficient sanitization of user-supplied data in the Notes column of the Alarms section. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code inside CKEditor using the <img> tag in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

2) Cross-site scripting (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in the HTML parser due to insufficient sanitization of user-supplied data in the Notes column of the Alarms section. A remote attacker can switch CKEditor to source mode, trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

3) Cross-site scripting (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in the online media asset rendering (*.youtube and *.vimeo files) due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

4) Cross-site scripting (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in modal windows in the TYPO3 backend due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

5) Cross-site scripting (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in login status display in the website frontend due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

6) Security restrictions bypass (CVE-ID: N/A)

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to cookies created in the Install Tool are not hardened to be submitted only via HTTP. A remote attacker can bypass security restrictions, conduct cross-site scripting and hijack an active and valid session in the Install Tool.

7) Information disclosure (CVE-ID: N/A)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to Install Tool exposes the current TYPO3 version number A remote attacker can gain access to arbitrary data.

8) Improper input validation (CVE-ID: N/A)

The vulnerability allows a remote authenticated attacker to cause DoS condition.

The vulnerability exists in Online Media Asset Handling (*.youtube and *.vimeo files) in the TYPO3 backend due to Install Tool exposes the current TYPO3 version number A remote authenticated attacker can put large files with according file extensions, trigger high consumption of system resources, exceed limits of the current PHP process which results in a dysfunctional backend component.

9) Denial of service (CVE-ID: N/A)

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists in TYPO3’s built-in record registration functionality (aka “basic shopping cart”) using recs URL parameters due to improper ensurement that anonymous user sessions are valid. A remote attacker can create an arbitrary amount of individual session-data records in the database and cause the service to crash.

Remediation

Install update from vendor's website.

References