CVE-2020-8091: XSS
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.
Other sources
TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 included a vulnerable external component, which could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 7.2.0 - Upgrade
Upgrade
composer/typo3/cmsto a version that resolves this vulnerability.Fixed in 6.2.39
Event History
Frequently Asked Questions
What is CVE-2020-8091?
CVE-2020-8091 is a cross-site scripting (XSS) vulnerability in TYPO3 versions 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0.
How can an attacker exploit CVE-2020-8091?
An unauthenticated, remote attacker can exploit CVE-2020-8091 to conduct a cross-site scripting (XSS) attack on a targeted system.
What is the severity of CVE-2020-8091?
CVE-2020-8091 has a severity rating of 6.1 (medium).
How can I fix CVE-2020-8091?
To fix CVE-2020-8091, update TYPO3 to version 7.2.0 for versions 7.0.0 to 7.1.0, and update TYPO3 to version 6.2.39 for versions 6.2.0 to 6.2.38 ELTS.
Where can I find more information about CVE-2020-8091?
You can find more information about CVE-2020-8091 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-8091), [TYPO3 Security Advisory](https://typo3.org/security/advisory/typo3-psa-2019-003/), [Purplemet Blog](https://www.purplemet.com/blog/typo3-xss-vulnerability).