{"id":"GHSA-gqqf-g5r7-84vf","aliases":[],"url":"https://o3.security/vulnerability/GHSA-gqqf-g5r7-84vf","summary":"TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection","details":"> ### Meta\n> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7)\n\n### Problem\nDue to a parsing issue in upstream package [`masterminds/html5`](https://packagist.org/packages/masterminds/html5), malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows to by-pass the cross-site scripting mechanism of [`typo3/html-sanitizer`](https://github.com/TYPO3/html-sanitizer).\n\n### Solution\nUpdate to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above.\n\n### Credits\nThanks to David Klein who reported this issue, and to TYPO3 security team member Oliver Hader who fixed the issue.\n\n### References\n* [TYPO3-CORE-SA-2022-011](https://typo3.org/security/advisory/typo3-core-sa-2022-011)\n* [GHSA-47m6-46mj-p235](https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-47m6-46mj-p235)\n","published":"2022-09-15T03:26:51Z","modified":"2024-12-06T05:37:17.196377Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"typo3/cms-core","fixedVersion":"7.6.58"},{"ecosystem":"Packagist","name":"typo3/cms-core","fixedVersion":"8.7.48"},{"ecosystem":"Packagist","name":"typo3/cms-core","fixedVersion":"9.5.37"},{"ecosystem":"Packagist","name":"typo3/cms-core","fixedVersion":"10.4.32"},{"ecosystem":"Packagist","name":"typo3/cms-core","fixedVersion":"11.5.16"}],"fix":{"url":"https://github.com/TYPO3/typo3/commit/d4f260570abd934fcf3819370a135bef33d729b7","label":"TYPO3/typo3@d4f2605"},"references":[{"type":"WEB","url":"https://github.com/TYPO3/typo3/security/advisories/GHSA-gqqf-g5r7-84vf"},{"type":"WEB","url":"https://github.com/TYPO3/typo3/commit/d4f260570abd934fcf3819370a135bef33d729b7"},{"type":"PACKAGE","url":"https://github.com/TYPO3/typo3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-06T05:37:17.196377Z"}}