Skip to content

Cross-Site Scripting in <f:asset.css> view helper

Moderate
ohader published GHSA-fv2m-9249-qx85 Sep 13, 2022

Package

composer typo3/cms-core (Composer)

Affected versions

10.3.0-10.4.31, 11.0.0-11.5.15

Patched versions

10.4.32, 11.5.16

Description

Meta

  • CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.1)

Problem

It has been discovered that the f:asset.css view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS.

Solution

Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem described above.

Credits

Thanks to TYPO3 contributor member Frank Nägler who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue.

References

Severity

Moderate
4.4
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
High
Privileges required
Low
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

CVE ID

CVE-2022-36108

Weaknesses

Credits