Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04NjQ4LWg1NTktOGg0Ms4AAyWy

Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting

All versions of Fluid Components before 3.5.0 were susceptible to Cross-Site Scripting. Version 3.5.0 of the extension fixes this issue. Due to the nature of the problem, some changes in your project's Fluid templates might be necessary to prevent unwanted double-escaping of HTML markup.

Permalink: https://github.com/advisories/GHSA-8648-h559-8h42
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04NjQ4LWg1NTktOGg0Ms4AAyWy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: 5 months ago

Identifiers: GHSA-8648-h559-8h42, CVE-2023-28604
References:

• https://github.com/FriendsOfPHP/security-advisories/blob/master/sitegeist/fluid-components/CVE-2023-28604.yaml
• https://github.com/sitegeist/fluid-components/blob/master/Documentation/XssIssue.md
• https://typo3.org/security/advisory/typo3-ext-sa-2023-003
• https://nvd.nist.gov/vuln/detail/CVE-2023-28604
• https://github.com/advisories/GHSA-8648-h559-8h42

Repository: https://github.com/sitegeist/fluid-components
Blast Radius: 0.0

Affected Packages