CVE-2018-6905: XSS
The page module in TYPO3 before 8.7.11 has XSS via $GLOBALS['TYPO3CONFVARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.
Other sources
The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3CONFVARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 9.2.0 - Upgrade
Upgrade
TYPO3 page moduleto a version that resolves this vulnerability.Fixed in 8.7.11
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6905?
CVE-2018-6905 is rated as a medium severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.
How do I fix CVE-2018-6905?
To fix CVE-2018-6905, you should upgrade TYPO3 to version 9.2.0 or later.
Which versions of TYPO3 are affected by CVE-2018-6905?
CVE-2018-6905 affects TYPO3 versions prior to 8.7.11 and versions from 9.0.0 up to 9.1.0.
What is the impact of CVE-2018-6905?
The impact of CVE-2018-6905 includes the risk of XSS attacks that could compromise the security of the TYPO3 installation.
Who can exploit CVE-2018-6905?
CVE-2018-6905 can be exploited by an authenticated user who can enter malicious input into the site name during installation.