CVE-2013-7074: XSS
First published: Sat Dec 21 2013(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/typo3/cms | >=6.1.0<=6.1.6 | 6.1.7 |
| composer/typo3/cms | >=6.0.0<=6.0.11 | 6.0.12 |
| composer/typo3/cms | >=4.7.0<=4.7.16 | 4.7.17 |
| composer/typo3/cms | >=4.5.0<=4.5.31 | 4.5.32 |
| TYPO3 | =6.1 | |
| TYPO3 | =6.1.1 | |
| TYPO3 | =6.1.2 | |
| TYPO3 | =6.1.3 | |
| TYPO3 | =6.1.4 | |
| TYPO3 | =6.1.5 | |
| TYPO3 | =6.1.6 | |
| TYPO3 | =4.7.0 | |
| TYPO3 | =4.7.1 | |
| TYPO3 | =4.7.2 | |
| TYPO3 | =4.7.3 | |
| TYPO3 | =4.7.4 | |
| TYPO3 | =4.7.5 | |
| TYPO3 | =4.7.6 | |
| TYPO3 | =4.7.7 | |
| TYPO3 | =4.7.8 | |
| TYPO3 | =4.7.9 | |
| TYPO3 | =4.7.10 | |
| TYPO3 | =4.7.11 | |
| TYPO3 | =4.7.12 | |
| TYPO3 | =4.7.13 | |
| TYPO3 | =4.7.14 | |
| TYPO3 | =4.7.15 | |
| TYPO3 | =4.7.16 | |
| TYPO3 | =6.2.0-beta1 | |
| TYPO3 | =6.2.0-beta2 | |
| TYPO3 | =6.2.0-beta3 | |
| TYPO3 | =4.5.0 | |
| TYPO3 | =4.5.1 | |
| TYPO3 | =4.5.2 | |
| TYPO3 | =4.5.3 | |
| TYPO3 | =4.5.4 | |
| TYPO3 | =4.5.5 | |
| TYPO3 | =4.5.6 | |
| TYPO3 | =4.5.7 | |
| TYPO3 | =4.5.8 | |
| TYPO3 | =4.5.9 | |
| TYPO3 | =4.5.10 | |
| TYPO3 | =4.5.11 | |
| TYPO3 | =4.5.12 | |
| TYPO3 | =4.5.13 | |
| TYPO3 | =4.5.14 | |
| TYPO3 | =4.5.15 | |
| TYPO3 | =4.5.16 | |
| TYPO3 | =4.5.17 | |
| TYPO3 | =4.5.18 | |
| TYPO3 | =4.5.19 | |
| TYPO3 | =4.5.20 | |
| TYPO3 | =4.5.21 | |
| TYPO3 | =4.5.22 | |
| TYPO3 | =4.5.23 | |
| TYPO3 | =4.5.24 | |
| TYPO3 | =4.5.25 | |
| TYPO3 | =4.5.26 | |
| TYPO3 | =4.5.27 | |
| TYPO3 | =4.5.28 | |
| TYPO3 | =4.5.29 | |
| TYPO3 | =4.5.30 | |
| TYPO3 | =4.5.31 | |
| TYPO3 | =6.0 | |
| TYPO3 | =6.0.1 | |
| TYPO3 | =6.0.2 | |
| TYPO3 | =6.0.3 | |
| TYPO3 | =6.0.4 | |
| TYPO3 | =6.0.5 | |
| TYPO3 | =6.0.6 | |
| TYPO3 | =6.0.7 | |
| TYPO3 | =6.0.8 | |
| TYPO3 | =6.0.9 | |
| TYPO3 | =6.0.10 | |
| TYPO3 | =6.0.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2013-7074
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89620
- http://osvdb.org/100881
- http://seclists.org/oss-sec/2013/q4/473
- http://seclists.org/oss-sec/2013/q4/487
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004
- http://www.debian.org/security/2014/dsa-2834
- http://www.securityfocus.com/bid/64245
- https://github.com/advisories/GHSA-r8m7-792j-5jvq (Advisory)
Frequently Asked Questions
What is the severity of CVE-2013-7074?
CVE-2013-7074 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2013-7074?
To fix CVE-2013-7074, upgrade TYPO3 to version 4.5.32, 4.7.17, 6.0.12, or 6.1.7, which contain patches for the vulnerability.
Which versions of TYPO3 are affected by CVE-2013-7074?
CVE-2013-7074 affects TYPO3 versions 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, and 6.1.x before 6.1.7.
Who can exploit CVE-2013-7074?
CVE-2013-7074 can be exploited by remote authenticated users to inject arbitrary web scripts or HTML into the application.
What is a cross-site scripting vulnerability like CVE-2013-7074?
Cross-site scripting vulnerabilities, like CVE-2013-7074, allow attackers to execute malicious scripts in users' browsers, potentially leading to data theft or session hijacking.
- collector/github-advisory-latest
- alias/GHSA-r8m7-792j-5jvq
- alias/CVE-2013-7074
- collector/github-advisory
- agent/author
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/severity
- agent/last-modified-date
- agent/description
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/typo3
- canonical/typo3 typo3
- version/typo3 typo3/6.1
- version/typo3 typo3/6.1.1
- version/typo3 typo3/6.1.2
- version/typo3 typo3/6.1.3
- version/typo3 typo3/6.1.4
- version/typo3 typo3/6.1.5
- version/typo3 typo3/6.1.6
- version/typo3 typo3/4.7.0
- version/typo3 typo3/4.7.1
- version/typo3 typo3/4.7.2
- version/typo3 typo3/4.7.3
- version/typo3 typo3/4.7.4
- version/typo3 typo3/4.7.5
- version/typo3 typo3/4.7.6
- version/typo3 typo3/4.7.7
- version/typo3 typo3/4.7.8
- version/typo3 typo3/4.7.9
- version/typo3 typo3/4.7.10
- version/typo3 typo3/4.7.11
- version/typo3 typo3/4.7.12
- version/typo3 typo3/4.7.13
- version/typo3 typo3/4.7.14
- version/typo3 typo3/4.7.15
- version/typo3 typo3/4.7.16
- version/typo3 typo3/6.2.0-beta1
- version/typo3 typo3/6.2.0-beta2
- version/typo3 typo3/6.2.0-beta3
- version/typo3 typo3/4.5.0
- version/typo3 typo3/4.5.1
- version/typo3 typo3/4.5.2
- version/typo3 typo3/4.5.3
- version/typo3 typo3/4.5.4
- version/typo3 typo3/4.5.5
- version/typo3 typo3/4.5.6
- version/typo3 typo3/4.5.7
- version/typo3 typo3/4.5.8
- version/typo3 typo3/4.5.9
- version/typo3 typo3/4.5.10
- version/typo3 typo3/4.5.11
- version/typo3 typo3/4.5.12
- version/typo3 typo3/4.5.13
- version/typo3 typo3/4.5.14
- version/typo3 typo3/4.5.15
- version/typo3 typo3/4.5.16
- version/typo3 typo3/4.5.17
- version/typo3 typo3/4.5.18
- version/typo3 typo3/4.5.19
- version/typo3 typo3/4.5.20
- version/typo3 typo3/4.5.21
- version/typo3 typo3/4.5.22
- version/typo3 typo3/4.5.23
- version/typo3 typo3/4.5.24
- version/typo3 typo3/4.5.25
- version/typo3 typo3/4.5.26
- version/typo3 typo3/4.5.27
- version/typo3 typo3/4.5.28
- version/typo3 typo3/4.5.29
- version/typo3 typo3/4.5.30
- version/typo3 typo3/4.5.31
- version/typo3 typo3/6.0
- version/typo3 typo3/6.0.1
- version/typo3 typo3/6.0.2
- version/typo3 typo3/6.0.3
- version/typo3 typo3/6.0.4
- version/typo3 typo3/6.0.5
- version/typo3 typo3/6.0.6
- version/typo3 typo3/6.0.7
- version/typo3 typo3/6.0.8
- version/typo3 typo3/6.0.9
- version/typo3 typo3/6.0.10
- version/typo3 typo3/6.0.11