Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2011-4632

Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message.

VectorNETWORK

PublishedNov 06, 2019, 17:15

Published Bysecalert@redhat.com

Base Score

Score5.4

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

typo3/cms(Packagist)04.3.12N/A

typo3/cms(Packagist)4.4.04.4.9N/A

typo3/cms(Packagist)4.5.04.5.4N/A

References

https://security-tracker.debian.org/tracker/CVE-2011-4632
https://typo3.org/security/advisory/typo3-core-sa-2011-001/#XSS

Weakness Type

CWE-79

CVSS Metrics

Base Score

5.4

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK