CVE-2012-6147: XSS
Published Jul 1, 2013
·Updated
Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
47 affected componentsFixes available
composer/typo3/cms>=4.7.0<4.7.6
4.7.6
composer/typo3/cms>=4.6.0<4.6.14
4.6.14
composer/typo3/cms>=4.5.0<4.5.21
4.5.21
Typo3 TYPO3=4.5
Typo3 TYPO3=4.5.0
Typo3 TYPO3=4.5.1
Typo3 TYPO3=4.5.2
Typo3 TYPO3=4.5.3
Typo3 TYPO3=4.5.4
Typo3 TYPO3=4.5.5
Typo3 TYPO3=4.5.6
Typo3 TYPO3=4.5.7
Typo3 TYPO3=4.5.8
Typo3 TYPO3=4.5.9
Typo3 TYPO3=4.5.10
Typo3 TYPO3=4.5.11
Typo3 TYPO3=4.5.12
Typo3 TYPO3=4.5.13
Typo3 TYPO3=4.5.14
Typo3 TYPO3=4.5.15
Typo3 TYPO3=4.5.16
Typo3 TYPO3=4.5.17
Typo3 TYPO3=4.5.18
Typo3 TYPO3=4.5.19
Typo3 TYPO3=4.5.20
Typo3 TYPO3=4.6
Typo3 TYPO3=4.6.0
Typo3 TYPO3=4.6.1
Typo3 TYPO3=4.6.2
Typo3 TYPO3=4.6.3
Typo3 TYPO3=4.6.4
Typo3 TYPO3=4.6.5
Typo3 TYPO3=4.6.6
Typo3 TYPO3=4.6.7
Typo3 TYPO3=4.6.8
Typo3 TYPO3=4.6.9
Typo3 TYPO3=4.6.10
Typo3 TYPO3=4.6.11
Typo3 TYPO3=4.6.12
Typo3 TYPO3=4.6.13
Typo3 TYPO3=4.7
Typo3 TYPO3=4.7.0
Typo3 TYPO3=4.7.1
Typo3 TYPO3=4.7.2
Typo3 TYPO3=4.7.3
Typo3 TYPO3=4.7.4
Typo3 TYPO3=4.7.5
Event History
Jul 1, 2013
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·01:37 AM
Frequently Asked Questions
1
What is the severity of CVE-2012-6147?
CVE-2012-6147 is classified as a medium severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2012-6147?
To fix CVE-2012-6147, upgrade TYPO3 to version 4.5.21, 4.6.14, or 4.7.6 or later.
3
Which versions of TYPO3 are affected by CVE-2012-6147?
Versions of TYPO3 before 4.5.21, 4.6.14, and 4.7.6 are affected by CVE-2012-6147.
4
Can CVE-2012-6147 be exploited by unauthenticated users?
No, CVE-2012-6147 requires remote authenticated backend users to exploit the vulnerability.
5
What type of vulnerability is CVE-2012-6147?
CVE-2012-6147 is a cross-site scripting (XSS) vulnerability.