CVE-2009-4963: XSS
Published Jul 27, 2010
·Updated
Cross-site scripting (XSS) vulnerability in the Commerce extension before 0.9.9 for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
17 affected componentsFixes available
Typo3 Commerce extension<=0.9.8
Typo3 Commerce extension=0.8.32
Typo3 Commerce extension=0.8.35
Typo3 Commerce extension=0.9.0
Typo3 Commerce extension=0.9.5
Typo3 Commerce extension=0.9.6
Typo3 Commerce extension=0.9.7
Typo3 TYPO3
composer/commerceteam/commerce>=0.9.6<0.9.9
0.9.9
All of the following
Any of the following
Typo3 Commerce extension<=0.9.8
Typo3 Commerce extension=0.8.32
Typo3 Commerce extension=0.8.35
Typo3 Commerce extension=0.9.0
Typo3 Commerce extension=0.9.5
Typo3 Commerce extension=0.9.6
Typo3 Commerce extension=0.9.7
Typo3 TYPO3
Remediation
Patch Available
Event History
Jul 27, 2010
CVE Published
via MITRE·06:39 PM
Data Sourced
via MITRE·06:39 PM
Description
Jul 28, 2010
Data Sourced
02:43 PM
DescriptionWeaknessAffected Software
Data Sourced
via NVD·02:43 PM
RemedyDescriptionSeverityWeaknessAffected Software
May 2, 2022
Advisory Published
via GitHub·03:59 AM
Data Sourced
via GitHub·03:59 AM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-4963?
CVE-2009-4963 is considered a high severity vulnerability due to its potential for exploitation via cross-site scripting (XSS).
2
How do I fix CVE-2009-4963?
To fix CVE-2009-4963, upgrade the Commerce extension for TYPO3 to version 0.9.9 or later.
3
Who is affected by CVE-2009-4963?
CVE-2009-4963 affects users of the TYPO3 Commerce extension versions prior to 0.9.9.
4
What type of vulnerability is CVE-2009-4963?
CVE-2009-4963 is classified as a cross-site scripting (XSS) vulnerability.
5
What impact does CVE-2009-4963 have?
CVE-2009-4963 allows remote authenticated users to inject arbitrary web script or HTML, which can lead to unauthorized actions or data compromise.