CVE-2020-16095: XSS

Q: Which deployments are affected by the URL-parameter XSS issue?

Only Kitodo.Presentation sites using the ListView, Navigation, or PageView plugins are affected by the URL-parameter output-encoding flaw.

Q: What must an attacker do to exploit the issue?

The CVSS vector indicates network exploitation with low attack complexity and no privileges required, but user interaction is required. An attacker would need to cause a user to interact with crafted input, such as a malicious URL parameter.

Q: Which versions contain fixes?

The issue is fixed in Kitodo.Presentation 3.1.2 and in version 2.3.1 on the 2.x branch. The 2.x branch is generally not recommended because it depends on an outdated TYPO3 version.

Q: Is the bundled jQuery issue known to be exploitable in Kitodo.Presentation?

Kitodo.Presentation includes jQuery 3.4.1, which has a known XSS vulnerability. However, no way to exploit that jQuery issue in Kitodo.Presentation is currently known.

Published Jul 29, 2020

Updated

Impact Kitodo.Presentation fails to properly encode URL parameters for output in HTML making it vulnerable to Cross Site Scripting (XSS). Only sites using the ListView, Navigation or PageView plugins are affected.

It also includes jQuery 3.4.1 which is known to be vulnerable against Cross Site Scripting, although there is currently no known way to exploit this in Kitodo.Presentation.

Patches An updated version of Kitodo.Presentation is available on GitHub, Packagist and in the TYPO3 Extension Repository. Users are advised to update as soon as possible.

The issue was also fixed in release 2.3.1 of the 2.x branch, although it is generally not recommended to run this branch since it depends on an outdated TYPO3 version.

References TYPO3 Security Advisory TYPO3-EXT-SA-2020-015 jQuery Security Advisory GHSA-gxr4-xjj5-5px2 Open Bug Bounty Report OBB-1219978

Contact If you have any questions or comments about this advisory: Open an issue Email us at security@kitodo.org

Other sources

The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.

Affected Software

2 affected componentsFixes available

composer/kitodo/presentation<3.1.2

3.1.2

Kitodo Kitodo.presentation Typo3<3.1.2

Remediation

Patch Available

https://typo3.org/security/advisory/typo3-ext-sa-2020-015

Event History

Jul 29, 2020

CVE Published

via MITRE·02:45 PM

Data Sourced

via MITRE·02:45 PM

Description

Jul 31, 2020

Advisory Published

via GitHub·05:39 PM

Frequently Asked Questions

Which deployments are affected by the URL-parameter XSS issue?

Only Kitodo.Presentation sites using the ListView, Navigation, or PageView plugins are affected by the URL-parameter output-encoding flaw.

What must an attacker do to exploit the issue?

The CVSS vector indicates network exploitation with low attack complexity and no privileges required, but user interaction is required. An attacker would need to cause a user to interact with crafted input, such as a malicious URL parameter.

Which versions contain fixes?

The issue is fixed in Kitodo.Presentation 3.1.2 and in version 2.3.1 on the 2.x branch. The 2.x branch is generally not recommended because it depends on an outdated TYPO3 version.

Is the bundled jQuery issue known to be exploitable in Kitodo.Presentation?

Kitodo.Presentation includes jQuery 3.4.1, which has a known XSS vulnerability. However, no way to exploit that jQuery issue in Kitodo.Presentation is currently known.

CVE-2020-16095: XSS

Other sources

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Which deployments are affected by the URL-parameter XSS issue?

What must an attacker do to exploit the issue?

Which versions contain fixes?

Is the bundled jQuery issue known to be exploitable in Kitodo.Presentation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected by the URL-parameter XSS issue?

What must an attacker do to exploit the issue?

Which versions contain fixes?

Is the bundled jQuery issue known to be exploitable in Kitodo.Presentation?