CVE-2023-47125

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

View graph Watch Export

CVSS v3.1

4.7 MEDIUM

EPSS

0.57%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityHIGH

Privileges RequiredNONE

User InteractionREQUIRED

ScopeCHANGED

ConfidentialityLOW

IntegrityLOW

AvailabilityNONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Connections

3 relationships

CWE-79

source

Timeline

disclosure → media coverage

Nov 14, 2023

Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024

Public PoC (1)

github.com/nikn0laty/TYPO3-HTML-Sanitizer-XSS-CVE-2023-47125

Unverified third-party code — review before executing.