CVE-2020-15241

Cross-Site Scripting in TYPO3 Fluid Engine

State: Published
Severity: 4.7 Medium
Published: Oct 8, 2020
Updated: Aug 4, 2024
Reserved: Jun 25, 2020

Description

TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-601 {"CWE-601":"URL Redirection to Untrusted Site ('Open Redirect')"}

Affected Products

Product	Versions
FluidTYPO3	>= 2.0.0, < 2.0.5Affected >= 2.1.0, < 2.1.4Affected >= 2.2.0, < 2.2.1Affected >= 2.3.0, < 2.3.5Affected >= 2.4.0, < 2.4.1Affected >= 2.5.0, < 2.5.5Affected >= 2.6.0, < 2.6.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.