CVE-2012-6148: XSS
Published Jul 1, 2013
·Updated
Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
47 affected componentsFixes available
composer/typo3/cms>=4.7.0<4.7.6
4.7.6
composer/typo3/cms>=4.6.0<4.6.14
4.6.14
composer/typo3/cms>=4.5.0<4.5.21
4.5.21
Typo3 TYPO3=4.5
Typo3 TYPO3=4.5.0
Typo3 TYPO3=4.5.1
Typo3 TYPO3=4.5.2
Typo3 TYPO3=4.5.3
Typo3 TYPO3=4.5.4
Typo3 TYPO3=4.5.5
Typo3 TYPO3=4.5.6
Typo3 TYPO3=4.5.7
Typo3 TYPO3=4.5.8
Typo3 TYPO3=4.5.9
Typo3 TYPO3=4.5.10
Typo3 TYPO3=4.5.11
Typo3 TYPO3=4.5.12
Typo3 TYPO3=4.5.13
Typo3 TYPO3=4.5.14
Typo3 TYPO3=4.5.15
Typo3 TYPO3=4.5.16
Typo3 TYPO3=4.5.17
Typo3 TYPO3=4.5.18
Typo3 TYPO3=4.5.19
Typo3 TYPO3=4.5.20
Typo3 TYPO3=4.6
Typo3 TYPO3=4.6.0
Typo3 TYPO3=4.6.1
Typo3 TYPO3=4.6.2
Typo3 TYPO3=4.6.3
Typo3 TYPO3=4.6.4
Typo3 TYPO3=4.6.5
Typo3 TYPO3=4.6.6
Typo3 TYPO3=4.6.7
Typo3 TYPO3=4.6.8
Typo3 TYPO3=4.6.9
Typo3 TYPO3=4.6.10
Typo3 TYPO3=4.6.11
Typo3 TYPO3=4.6.12
Typo3 TYPO3=4.6.13
Typo3 TYPO3=4.7
Typo3 TYPO3=4.7.0
Typo3 TYPO3=4.7.1
Typo3 TYPO3=4.7.2
Typo3 TYPO3=4.7.3
Typo3 TYPO3=4.7.4
Typo3 TYPO3=4.7.5
Event History
Jul 1, 2013
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·01:37 AM
Frequently Asked Questions
1
What is the severity of CVE-2012-6148?
CVE-2012-6148 has a moderate severity, as it allows remote authenticated backend users to inject arbitrary web scripts or HTML.
2
How do I fix CVE-2012-6148?
To fix CVE-2012-6148, upgrade TYPO3 to version 4.5.21, 4.6.14, or 4.7.6 or higher.
3
What versions of TYPO3 are affected by CVE-2012-6148?
CVE-2012-6148 affects TYPO3 versions 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6.
4
Who can exploit CVE-2012-6148?
CVE-2012-6148 can be exploited by remote authenticated backend users.
5
What types of attacks are possible due to CVE-2012-6148?
CVE-2012-6148 allows for Cross-site Scripting (XSS) attacks that can inject arbitrary web scripts or HTML.