XSS in Typo3 Html-Sanitizer
CVE-2023-38500
TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.005 (40.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Typo3 Html-sanitizer — versions >= 1.0.0, < 1.5.1, >= 2.0.0, < 2.1.2
- Typo3 Html_sanitizer
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-38500?
- CVE-2023-38500 is a medium-severity vulnerability in Typo3 Html-Sanitizer, classified under Cross-site Scripting. CVSS score: 4.7/10. Published 2023-07-25.
- How severe is CVE-2023-38500?
- Medium severity. CVSS v3 base score is 4.7 out of 10.