CVE-2009-3633: TYPO3 API function vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the t3libdiv::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing algorithm.
Other sources
Cross-site scripting (XSS) vulnerability in the t3libdiv::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing algorithm.
— MITRE
TYPO3 API function vulnerable to Cross-site Scripting
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 4.3beta2 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 4.2.10 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 4.1.13
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3633?
CVE-2009-3633 has a severity rating that allows remote attackers to execute arbitrary web scripts or HTML via cross-site scripting vulnerabilities.
How do I fix CVE-2009-3633?
To fix CVE-2009-3633, you should upgrade to TYPO3 version 4.3beta2 or later, 4.2.10 or later, or 4.1.13 or later.
Which versions of TYPO3 are affected by CVE-2009-3633?
CVE-2009-3633 affects TYPO3 versions 4.0.13 and earlier, as well as specific earlier versions in the 4.1.x, 4.2.x, and 4.3.x series.
Is CVE-2009-3633 a cross-site scripting vulnerability?
Yes, CVE-2009-3633 is identified as a cross-site scripting (XSS) vulnerability.
Can CVE-2009-3633 lead to data theft?
Yes, CVE-2009-3633 could potentially allow attackers to steal sensitive information through injected scripts.