CVE-2012-1608

The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/48647	Vendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/	Vendor Advisory
http://www.debian.org/security/2012/dsa-2445
http://www.openwall.com/lists/oss-security/2012/03/30/4
http://www.osvdb.org/80762
http://www.securityfocus.com/bid/52771
http://secunia.com/advisories/48647	Vendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/	Vendor Advisory
http://www.debian.org/security/2012/dsa-2445
http://www.openwall.com/lists/oss-security/2012/03/30/4
http://www.osvdb.org/80762
http://www.securityfocus.com/bid/52771

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:typo3:typo3:4.4.0:::::::*
	cpe:2.3:a:typo3:typo3:4.4.1:::::::*
	cpe:2.3:a:typo3:typo3:4.4.2:::::::*
	cpe:2.3:a:typo3:typo3:4.4.3:::::::*
	cpe:2.3:a:typo3:typo3:4.4.4:::::::*
	cpe:2.3:a:typo3:typo3:4.4.5:::::::*
	cpe:2.3:a:typo3:typo3:4.4.6:::::::*
	cpe:2.3:a:typo3:typo3:4.4.7:::::::*
	cpe:2.3:a:typo3:typo3:4.4.8:::::::*
	cpe:2.3:a:typo3:typo3:4.4.9:::::::*
	cpe:2.3:a:typo3:typo3:4.4.10:::::::*
	cpe:2.3:a:typo3:typo3:4.4.11:::::::*
	cpe:2.3:a:typo3:typo3:4.4.12:::::::*
	cpe:2.3:a:typo3:typo3:4.4.13:::::::*
	cpe:2.3:a:typo3:typo3:4.5.0:::::::*
	cpe:2.3:a:typo3:typo3:4.5.1:::::::*
	cpe:2.3:a:typo3:typo3:4.5.2:::::::*
	cpe:2.3:a:typo3:typo3:4.5.3:::::::*
	cpe:2.3:a:typo3:typo3:4.5.4:::::::*
	cpe:2.3:a:typo3:typo3:4.5.5:::::::*
	cpe:2.3:a:typo3:typo3:4.5.6:::::::*
	cpe:2.3:a:typo3:typo3:4.5.7:::::::*
	cpe:2.3:a:typo3:typo3:4.5.8:::::::*
	cpe:2.3:a:typo3:typo3:4.5.9:::::::*
	cpe:2.3:a:typo3:typo3:4.5.10:::::::*
	cpe:2.3:a:typo3:typo3:4.5.11:::::::*
	cpe:2.3:a:typo3:typo3:4.5.12:::::::*
	cpe:2.3:a:typo3:typo3:4.5.13:::::::*
	cpe:2.3:a:typo3:typo3:4.6.0:::::::*
	cpe:2.3:a:typo3:typo3:4.6.1:::::::*
	cpe:2.3:a:typo3:typo3:4.6.2:::::::*
	cpe:2.3:a:typo3:typo3:4.6.3:::::::*
	cpe:2.3:a:typo3:typo3:4.6.4:::::::*
	cpe:2.3:a:typo3:typo3:4.6.5:::::::*
	cpe:2.3:a:typo3:typo3:4.6.6:::::::*
	cpe:2.3:a:typo3:typo3:4.7:::::::*
	cpe:2.3:a:typo3:typo3:6.0:::::::*

History

21 Nov 2024, 01:37

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/48647 - Vendor Advisory~~	() http://secunia.com/advisories/48647 - Vendor Advisory
References	~~() http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/ - Vendor Advisory~~	() http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/ - Vendor Advisory
References	~~() http://www.debian.org/security/2012/dsa-2445 -~~	() http://www.debian.org/security/2012/dsa-2445 -
References	~~() http://www.openwall.com/lists/oss-security/2012/03/30/4 -~~	() http://www.openwall.com/lists/oss-security/2012/03/30/4 -
References	~~() http://www.osvdb.org/80762 -~~	() http://www.osvdb.org/80762 -
References	~~() http://www.securityfocus.com/bid/52771 -~~	() http://www.securityfocus.com/bid/52771 -

Information

Published : 2012-09-04 20:55

Updated : 2024-11-21 01:37

NVD link : CVE-2012-1608

Mitre link : CVE-2012-1608

CVE.ORG link : CVE-2012-1608

JSON object : View

Products Affected

typo3

typo3

CWE

CWE-20

Improper Input Validation

5.0 /10