TYPO3 Cross-Site Scripting in Frontend User Login
Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile.
Template patterns that are affected are
- ###FEUSER_[fieldName]### using system extension felogin
- <!--###USERNAME###--> for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)
| Software | From | Fixed in |
|---|---|---|
typo3 / cms
|
7.0.0 | 7.6.32 |
|
typo3 / cms
|
8.0.0 | 8.7.21 |
|
typo3 / cms
|
9.0.0 | 9.5.2 |
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2018-12-11-3.yaml
- https://github.com/TYPO3/typo3/commit/1c85fe70269e2ff8ecf0b6d5f16550c6cd0ddc78
- https://github.com/TYPO3/typo3/commit/373bec5d7d415f0764ebbadc7970610dc26da068
- https://github.com/TYPO3/typo3/commit/e4143195e1451630f058a58ab62d92135948a927
- https://typo3.org/security/advisory/typo3-core-sa-2018-008
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime