CVE-2020-26227CWE-79

Cross-Site Scripting in Fluid view helpers

Medium · published November 23, 2020

CVSS v3.1
6.1
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00724 · 53.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-11-23T21:05Z
EPSS history
Timeline
  • 23 NOV 21:05Z
    Cross-Site Scripting in Fluid view helpers
    cvelistv5