CVE-2012-6147

TYPO3 4.5.0-4.5.20, 4.6.0-4.6.13, 4.7.0-4.7.5 - Authenticated Cross-Site Scripting in TCA-Tree Backend API

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/79967
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/87113
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/06/19/4

Scores

EPSS 0.0020
EPSS Percentile 41.3%

Details

CWE
CWE-79
Status published
Products (45)
typo3/cms 4.5.0 - 4.5.21Packagist
typo3/typo3 4.5
typo3/typo3 4.5.0
typo3/typo3 4.5.1
typo3/typo3 4.5.2
typo3/typo3 4.5.3
typo3/typo3 4.5.4
typo3/typo3 4.5.5
typo3/typo3 4.5.6
typo3/typo3 4.5.7
... and 35 more
Published Jul 01, 2013
Tracked Since Feb 18, 2026