CVE-2020-15241: Cross-Site Scripting in Fluid Engine
### Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0) CWE-79
---
:informationsource: This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020
---
Problem It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.
{showFullName ? fullName : defaultValue}
Solution Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described.
Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.5) TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1)
Credits Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.
References TYPO3-CORE-SA-2019-013
Other sources
TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 9.5.6 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 8.7.25 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 9.5.6 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 8.7.25 - Upgrade
Upgrade
composer/typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.6.1 - Upgrade
Upgrade
composer/typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.5.5 - Upgrade
Upgrade
composer/typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.4.1 - Upgrade
Upgrade
composer/typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.3.5 - Upgrade
Upgrade
composer/typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.2.1 - Upgrade
Upgrade
composer/typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.1.4 - Upgrade
Upgrade
composer/typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.0.5 - Upgrade
Upgrade
typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.0.5 - Upgrade
Upgrade
typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.1.4 - Upgrade
Upgrade
typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.2.1 - Upgrade
Upgrade
typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.3.5 - Upgrade
Upgrade
typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.4.1 - Upgrade
Upgrade
typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.5.5 - Upgrade
Upgrade
typo3fluid/fluidto a version that resolves this vulnerability.Fixed in 2.6.1
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15241?
CVE-2020-15241 has a CVSS score of 5.0, indicating moderate severity.
How do I fix CVE-2020-15241?
To fix CVE-2020-15241, upgrade TYPO3 CMS to version 9.5.6 or 8.7.25, or Fluid to version 2.6.1, 2.5.5, 2.4.1, 2.3.5, 2.2.1, 2.1.4, or 2.0.5.
What types of software are affected by CVE-2020-15241?
CVE-2020-15241 affects TYPO3 CMS versions 8.0.0 to 8.7.25 and 9.0.0 to 9.5.6, as well as Fluid versions 2.0.0 to 2.0.5 and various 2.x releases.
Is CVE-2020-15241 still exploitable?
CVE-2020-15241 was fixed in May 2019, so it is no longer exploitable in patched versions.
What is the primary impact of CVE-2020-15241?
CVE-2020-15241 is classified under CWE-79, which relates to improper neutralization of input during web page generation, potentially leading to XSS attacks.