TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component
Date: 2022-05
Affected: composer/typo3/cms, composer/typo3/cms, composer/typo3/cms
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2013-7074
CVE-2013-7077
CVE-2013-7078
CWE: CWE-79
CVSS: 3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N)

Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.


Mitigations:

Architectural layers (MAESTRO):