CVE-2010-3659: TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms
Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified parameters to unknown backend forms.
Other sources
TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 4.4.1 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 4.3.4 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 4.2.13 - Upgrade
Upgrade
composer/typo3/cms-backendto a version that resolves this vulnerability.Fixed in 4.1.14
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3659?
CVE-2010-3659 is classified as having moderate severity due to its multiple cross-site scripting (XSS) vulnerabilities.
How do I fix CVE-2010-3659?
You can resolve CVE-2010-3659 by upgrading TYPO3 to versions 4.1.14, 4.2.13, 4.3.4, or 4.4.1 or higher.
What systems are affected by CVE-2010-3659?
CVE-2010-3659 affects TYPO3 CMS versions 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1.
Can CVE-2010-3659 be exploited remotely?
Yes, CVE-2010-3659 can be exploited remotely by authenticated backend users to inject arbitrary web scripts or HTML.
What measures can I take to mitigate CVE-2010-3659?
To mitigate CVE-2010-3659, users should apply the latest security patches and limit backend access to trusted users only.