CVE-2020-11070CWE-79

Cross-Site Scripting in SVG Sanitizer

Medium · published May 13, 2020

CVSS v3.1
5.4
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. This is fixed in version 1.0.3.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00540 · 44.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-05-13T18:40Z
EPSS history
Timeline
  • 13 MAY 18:40Z
    Cross-Site Scripting in SVG Sanitizer
    cvelistv5