NetSight
IP …
medium4.7

CVE-2020-15241

TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when ma…

Impact

TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).

Affected products

VendorProductAffected versions
Typo3Fluid Engine
before 2.0.5
from 2.1.0 before 2.1.4
from 2.2.0 before 2.2.1
from 2.3.0 before 2.3.5
from 2.4.0 before 2.4.1
from 2.5.0 before 2.5.5
Typo3Typo3
Versions 8.7.25, 9.5.6

Weakness classification

CWE-601CWE-79

References