CVE-2014-3943

TYPO3 4.5.0-4.5.33, 4.7.0-4.7.18, 6.0.0-6.0.13, 6.1.0-6.1.8, 6.2.0-6.2.2 - Authenticated Cross-Site Scripting

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via unknown parameters.

References (5)

Core 5
Core References
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2942
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/06/03/2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/67625

Scores

EPSS 0.0021
EPSS Percentile 43.0%

Details

CWE
CWE-79
Status published
Products (50)
typo3/cms 4.5.0 - 4.5.34Packagist
typo3/typo3 4.5.0
typo3/typo3 4.5.1
typo3/typo3 4.5.2
typo3/typo3 4.5.3
typo3/typo3 4.5.4
typo3/typo3 4.5.5
typo3/typo3 4.5.6
typo3/typo3 4.5.7
typo3/typo3 4.5.8
... and 40 more
Published Jun 03, 2014
Tracked Since Feb 18, 2026