XSS in Typo3 Html-Sanitizer
CVE-2023-47125
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.006 (44.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Typo3 Html-sanitizer — versions >= 1.0.0, < 1.5.3, >= 2.0.0, < 2.1.4
- Typo3 Html_sanitizer
- Typo3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-47125?
- CVE-2023-47125 is a medium-severity vulnerability in Typo3 Html-Sanitizer, classified under Cross-site Scripting. CVSS score: 4.7/10. Published 2023-11-14.
- How severe is CVE-2023-47125?
- Medium severity. CVSS v3 base score is 4.7 out of 10.
- Is CVE-2023-47125 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.