CVE-2012-3530: Typo3 API XSS Vulnerability
Incomplete blacklist vulnerability in the t3libdiv::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
Other sources
Incomplete blacklist vulnerability in the t3libdiv::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 4.7.4 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 4.6.12 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 4.5.19
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3530?
CVE-2012-3530 has a medium severity level, allowing for cross-site scripting attacks.
How do I fix CVE-2012-3530?
To fix CVE-2012-3530, upgrade to TYPO3 versions 4.5.19, 4.6.12, or 4.7.4 or later.
What software is affected by CVE-2012-3530?
CVE-2012-3530 affects TYPO3 versions prior to 4.5.19, 4.6.12, and 4.7.4.
Can CVE-2012-3530 be exploited remotely?
Yes, CVE-2012-3530 can be exploited remotely by attackers through JavaScript events.
Is there a patch available for CVE-2012-3530?
Yes, patches are included in TYPO3 versions 4.5.19, 4.6.12, and 4.7.4.