CVE-2020-8091: XSS
First published: Mon Jan 27 2020(Updated: )
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/typo3/cms | >=7.0.0<=7.1.0 | 7.2.0 |
| composer/typo3/cms | >=6.2.0<=6.2.38 | 6.2.39 |
| Typo3 Typo3 | >=6.2<6.2.39 | |
| Typo3 Typo3 | >=7.0.0<=7.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2020-8091
- https://typo3.org/security/advisory/typo3-psa-2019-003/
- https://www.purplemet.com/blog/typo3-xss-vulnerability
- https://github.com/TYPO3/typo3/blob/4cb53e828bd5138d180cdf9cac1ccf7fd31086d2/typo3/sysext/core/Documentation/Changelog/7.2/Breaking-65962-WebSVGLibraryAndAPIRemoved.rst
- https://github.com/TYPO3/typo3/commit/482e2e992f80f5e38cb48fcaea40fd9812a5252c
- https://github.com/advisories/GHSA-qvhv-pwww-53jj (Advisory)
Frequently Asked Questions
What is CVE-2020-8091?
CVE-2020-8091 is a cross-site scripting (XSS) vulnerability in TYPO3 versions 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0.
How can an attacker exploit CVE-2020-8091?
An unauthenticated, remote attacker can exploit CVE-2020-8091 to conduct a cross-site scripting (XSS) attack on a targeted system.
What is the severity of CVE-2020-8091?
CVE-2020-8091 has a severity rating of 6.1 (medium).
How can I fix CVE-2020-8091?
To fix CVE-2020-8091, update TYPO3 to version 7.2.0 for versions 7.0.0 to 7.1.0, and update TYPO3 to version 6.2.39 for versions 6.2.0 to 6.2.38 ELTS.
Where can I find more information about CVE-2020-8091?
You can find more information about CVE-2020-8091 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-8091), [TYPO3 Security Advisory](https://typo3.org/security/advisory/typo3-psa-2019-003/), [Purplemet Blog](https://www.purplemet.com/blog/typo3-xss-vulnerability).
- collector/github-advisory-latest
- alias/GHSA-qvhv-pwww-53jj
- alias/CVE-2020-8091
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/composer
- vendor/typo3
- canonical/typo3 typo3
- version/typo3 typo3/6.2
- version/typo3 typo3/7.0.0
- version/typo3 typo3/7.1.0