From 6bc3ad4d7cdbfa9a92cacf04e12d6ade466e1900 Mon Sep 17 00:00:00 2001 From: Florian Smeets Date: Sun, 27 Feb 2022 17:43:37 +0100 Subject: [PATCH] security/vuxml: Document TYPO3 vulnerabilities PR: 262196, 262197 --- security/vuxml/vuln-2022.xml | 37 ++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index ee851c6b3bc8..bab1342e8038 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,40 @@ + + typo3 -- XSS vulnerability in svg-sanitize + + + typo3-10-php74 + 10.4.25 + + + typo3-11-php74 + typo3-11-php80 + typo3-11-php81 + 11.5.7 + + + + +

The TYPO3 project reports:

+
+

The SVG sanitizer library enshrined/svg-sanitize before version + 0.15.0 did not remove HTML elements wrapped in a CDATA section. + As a result, SVG content embedded in HTML (fetched as text/html) + was susceptible to cross-site scripting. Plain SVG files + (fetched as image/svg+xml) were not affected.

+
+ + + + CVE-2022-23638 + https://github.com/typo3/typo3/commit/9940defb21 + https://typo3.org/article/typo3-psa-2022-001 + + + 2022-02-22 + 2022-02-27 + + + Grafana -- Teams API IDOR