Multiple vulnerabilities in TYPO3

1) Cross-site scripting

EUVDB-ID: #VU16751

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in the Enhanced Image (image2) plugin due to insufficient sanitization of user-supplied data in the Notes column of the Alarms section. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code inside CKEditor using the <img> tag in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

The vulnerability has been fixed in the version 8.7.21.

Vulnerable software versions

TYPO3: 8.5.0 - 8.7.20

CPE2.3

External links

https://typo3.org/security/advisory/typo3-core-sa-2018-005/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site scripting

EUVDB-ID: #VU16752

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in the HTML parser due to insufficient sanitization of user-supplied data in the Notes column of the Alarms section. A remote attacker can switch CKEditor to source mode, trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

The vulnerability has been fixed in the version 8.7.21 and 9.5.2.

Vulnerable software versions

TYPO3: 8.5.0 - 9.5.1

CPE2.3

External links

https://typo3.org/security/advisory/typo3-core-sa-2018-005/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cross-site scripting

EUVDB-ID: #VU16753

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in the online media asset rendering (*.youtube and *.vimeo files) due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

The vulnerability has been fixed in the versions 7.6.32, 8.7.21 and 9.5.2.

Vulnerable software versions

TYPO3: 7.5.0 - 9.5.1

CPE2.3

External links

https://typo3.org/security/advisory/typo3-core-sa-2018-006/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Cross-site scripting

EUVDB-ID: #VU16754

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in modal windows in the TYPO3 backend due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

The vulnerability has been fixed in the versions 7.6.32, 8.7.21 and 9.5.2.

Vulnerable software versions

TYPO3: 7.0.1 - 9.5.1

CPE2.3

External links

https://typo3.org/security/advisory/typo3-core-sa-2018-007/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Cross-site scripting

EUVDB-ID: #VU16755

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in login status display in the website frontend due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

The vulnerability has been fixed in the versions 7.6.32, 8.7.21 and 9.5.2.

Vulnerable software versions

TYPO3: 7.5.0 - 9.5.1

CPE2.3

External links

https://typo3.org/security/advisory/typo3-core-sa-2018-008/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Security restrictions bypass

EUVDB-ID: #VU16756

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to cookies created in the Install Tool are not hardened to be submitted only via HTTP. A remote attacker can bypass security restrictions, conduct cross-site scripting and hijack an active and valid session in the Install Tool.

Mitigation

The vulnerability has been fixed in the versions 7.6.32, 8.7.21 and 9.5.2.

Vulnerable software versions

TYPO3: 7.0.0 - 9.5.1

CPE2.3

External links

https://typo3.org/security/advisory/typo3-core-sa-2018-009/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Information disclosure

EUVDB-ID: #VU16757

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to Install Tool exposes the current TYPO3 version number A remote attacker can gain access to arbitrary data.

Mitigation

The vulnerability has been fixed in the versions 7.6.32, 8.7.21 and 9.5.2.

Vulnerable software versions

TYPO3: 7.0.0 - 9.5.1

CPE2.3

External links

https://typo3.org/security/advisory/typo3-core-sa-2018-010/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper input validation

EUVDB-ID: #VU16758

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to cause DoS condition.

The vulnerability exists in Online Media Asset Handling (*.youtube and *.vimeo files) in the TYPO3 backend due to Install Tool exposes the current TYPO3 version number A remote authenticated attacker can put large files with according file extensions, trigger high consumption of system resources, exceed limits of the current PHP process which results in a dysfunctional backend component.

Mitigation

The vulnerability has been fixed in the versions 7.6.32, 8.7.21 and 9.5.2.

Vulnerable software versions

TYPO3: 7.0.0 - 9.5.1

CPE2.3

External links

https://typo3.org/security/advisory/typo3-core-sa-2018-011/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Denial of service

EUVDB-ID: #VU16759

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists in TYPO3’s built-in record registration functionality (aka “basic shopping cart”) using recs URL parameters due to improper ensurement that anonymous user sessions are valid. A remote attacker can create an arbitrary amount of individual session-data records in the database and cause the service to crash.

Mitigation

The vulnerability has been fixed in the versions 7.6.32, 8.7.21.

Vulnerable software versions

TYPO3: 7.0.0 - 8.7.20

CPE2.3

External links

https://typo3.org/security/advisory/typo3-core-sa-2018-012/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Low
Patch available	YES
Number of vulnerabilities	9
CVE-ID	N/A
CWE-ID	CWE-79 CWE-264 CWE-200 CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	TYPO3 Web applications / CMS
Vendor	TYPO3