CVE-2013-7078: XSS
First published: Sun Jan 19 2014(Updated: )
Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6, when the Rewritten Property Mapper is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message. NOTE: this might be the same vulnerability as CVE-2013-7072.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/typo3/cms-core | >=6.0.0<6.0.11 | 6.0.11 |
| composer/typo3/cms-core | >=6.1.0<6.1.6 | 6.1.6 |
| composer/typo3/cms-core | >=4.7.0<4.7.16 | 4.7.16 |
| composer/typo3/cms-core | >=4.5.0<4.5.31 | 4.5.31 |
| TYPO3 | =6.0 | |
| TYPO3 | =6.0.1 | |
| TYPO3 | =6.0.2 | |
| TYPO3 | =6.0.3 | |
| TYPO3 | =6.0.4 | |
| TYPO3 | =6.0.5 | |
| TYPO3 | =6.0.6 | |
| TYPO3 | =6.0.7 | |
| TYPO3 | =6.0.8 | |
| TYPO3 | =6.0.9 | |
| TYPO3 | =6.0.10 | |
| TYPO3 | =6.0.11 | |
| TYPO3 | =6.1 | |
| TYPO3 | =6.1.1 | |
| TYPO3 | =6.1.2 | |
| TYPO3 | =6.1.3 | |
| TYPO3 | =6.1.4 | |
| TYPO3 | =6.1.5 | |
| TYPO3 | =6.1.6 | |
| TYPO3 | =4.7 | |
| TYPO3 | =4.7.0 | |
| TYPO3 | =4.7.1 | |
| TYPO3 | =4.7.2 | |
| TYPO3 | =4.7.3 | |
| TYPO3 | =4.7.4 | |
| TYPO3 | =4.7.5 | |
| TYPO3 | =4.7.6 | |
| TYPO3 | =4.7.7 | |
| TYPO3 | =4.7.8 | |
| TYPO3 | =4.7.9 | |
| TYPO3 | =4.7.10 | |
| TYPO3 | =4.7.11 | |
| TYPO3 | =4.7.12 | |
| TYPO3 | =4.7.13 | |
| TYPO3 | =4.7.14 | |
| TYPO3 | =4.7.15 | |
| TYPO3 | =4.7.16 | |
| TYPO3 | =4.5 | |
| TYPO3 | =4.5.0 | |
| TYPO3 | =4.5.1 | |
| TYPO3 | =4.5.2 | |
| TYPO3 | =4.5.3 | |
| TYPO3 | =4.5.4 | |
| TYPO3 | =4.5.5 | |
| TYPO3 | =4.5.6 | |
| TYPO3 | =4.5.7 | |
| TYPO3 | =4.5.8 | |
| TYPO3 | =4.5.9 | |
| TYPO3 | =4.5.10 | |
| TYPO3 | =4.5.11 | |
| TYPO3 | =4.5.12 | |
| TYPO3 | =4.5.13 | |
| TYPO3 | =4.5.14 | |
| TYPO3 | =4.5.15 | |
| TYPO3 | =4.5.16 | |
| TYPO3 | =4.5.17 | |
| TYPO3 | =4.5.18 | |
| TYPO3 | =4.5.19 | |
| TYPO3 | =4.5.20 | |
| TYPO3 | =4.5.21 | |
| TYPO3 | =4.5.22 | |
| TYPO3 | =4.5.23 | |
| TYPO3 | =4.5.24 | |
| TYPO3 | =4.5.25 | |
| TYPO3 | =4.5.26 | |
| TYPO3 | =4.5.27 | |
| TYPO3 | =4.5.28 | |
| TYPO3 | =4.5.29 | |
| TYPO3 | =4.5.30 | |
| TYPO3 | =4.5.31 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2013-7078
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89629
- http://osvdb.org/100885
- http://seclists.org/oss-sec/2013/q4/473
- http://seclists.org/oss-sec/2013/q4/487
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-004
- http://www.securityfocus.com/bid/64239
- https://github.com/advisories/GHSA-qj69-chjp-g4f5 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2013-7078?
CVE-2013-7078 is classified as a moderate severity vulnerability due to its potential for XSS attacks.
How do I fix CVE-2013-7078?
To fix CVE-2013-7078, upgrade TYPO3 to versions 4.5.31, 4.7.16, or 6.1.6 or later.
What does CVE-2013-7078 affect?
CVE-2013-7078 affects TYPO3 versions 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.1.6 when the Rewritten Property Mapper is enabled.
Who is vulnerable to CVE-2013-7078?
Remote attackers targeting installations of TYPO3 with affected versions may exploit CVE-2013-7078.
What type of vulnerability is CVE-2013-7078?
CVE-2013-7078 is a cross-site scripting (XSS) vulnerability.
- collector/github-advisory-latest
- alias/GHSA-qj69-chjp-g4f5
- alias/CVE-2013-7078
- collector/github-advisory
- agent/references
- agent/author
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/description
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/typo3
- canonical/typo3 typo3
- version/typo3 typo3/6.0
- version/typo3 typo3/6.0.1
- version/typo3 typo3/6.0.2
- version/typo3 typo3/6.0.3
- version/typo3 typo3/6.0.4
- version/typo3 typo3/6.0.5
- version/typo3 typo3/6.0.6
- version/typo3 typo3/6.0.7
- version/typo3 typo3/6.0.8
- version/typo3 typo3/6.0.9
- version/typo3 typo3/6.0.10
- version/typo3 typo3/6.0.11
- version/typo3 typo3/6.1
- version/typo3 typo3/6.1.1
- version/typo3 typo3/6.1.2
- version/typo3 typo3/6.1.3
- version/typo3 typo3/6.1.4
- version/typo3 typo3/6.1.5
- version/typo3 typo3/6.1.6
- version/typo3 typo3/4.7
- version/typo3 typo3/4.7.0
- version/typo3 typo3/4.7.1
- version/typo3 typo3/4.7.2
- version/typo3 typo3/4.7.3
- version/typo3 typo3/4.7.4
- version/typo3 typo3/4.7.5
- version/typo3 typo3/4.7.6
- version/typo3 typo3/4.7.7
- version/typo3 typo3/4.7.8
- version/typo3 typo3/4.7.9
- version/typo3 typo3/4.7.10
- version/typo3 typo3/4.7.11
- version/typo3 typo3/4.7.12
- version/typo3 typo3/4.7.13
- version/typo3 typo3/4.7.14
- version/typo3 typo3/4.7.15
- version/typo3 typo3/4.7.16
- version/typo3 typo3/4.5
- version/typo3 typo3/4.5.0
- version/typo3 typo3/4.5.1
- version/typo3 typo3/4.5.2
- version/typo3 typo3/4.5.3
- version/typo3 typo3/4.5.4
- version/typo3 typo3/4.5.5
- version/typo3 typo3/4.5.6
- version/typo3 typo3/4.5.7
- version/typo3 typo3/4.5.8
- version/typo3 typo3/4.5.9
- version/typo3 typo3/4.5.10
- version/typo3 typo3/4.5.11
- version/typo3 typo3/4.5.12
- version/typo3 typo3/4.5.13
- version/typo3 typo3/4.5.14
- version/typo3 typo3/4.5.15
- version/typo3 typo3/4.5.16
- version/typo3 typo3/4.5.17
- version/typo3 typo3/4.5.18
- version/typo3 typo3/4.5.19
- version/typo3 typo3/4.5.20
- version/typo3 typo3/4.5.21
- version/typo3 typo3/4.5.22
- version/typo3 typo3/4.5.23
- version/typo3 typo3/4.5.24
- version/typo3 typo3/4.5.25
- version/typo3 typo3/4.5.26
- version/typo3 typo3/4.5.27
- version/typo3 typo3/4.5.28
- version/typo3 typo3/4.5.29
- version/typo3 typo3/4.5.30
- version/typo3 typo3/4.5.31