3.5
CVSSv2

CVE-2012-1606

Published: 04/09/2012 Updated: 05/09/2012
CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8
VMScore: 312
Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N

Vulnerability Summary

Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 up to and including 4.4.13, 4.5.0 up to and including 4.5.13, 4.6.0 up to and including 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

Vulnerable Product Search on Vulmon Subscribe to Product

typo3 typo3 4.4.1

typo3 typo3 4.4.3

typo3 typo3 4.4.10

typo3 typo3 4.4.12

typo3 typo3 4.5.3

typo3 typo3 4.5.5

typo3 typo3 4.5.12

typo3 typo3 4.4.13

typo3 typo3 4.5.0

typo3 typo3 4.5.1

typo3 typo3 4.5.2

typo3 typo3 4.6.1

typo3 typo3 4.6.2

typo3 typo3 4.4.4

typo3 typo3 4.4.5

typo3 typo3 4.4.6

typo3 typo3 4.4.7

typo3 typo3 4.4.8

typo3 typo3 4.5.7

typo3 typo3 4.5.8

typo3 typo3 4.5.9

typo3 typo3 4.5.10

typo3 typo3 4.4.0

typo3 typo3 4.4.2

typo3 typo3 4.4.9

typo3 typo3 4.4.11

typo3 typo3 4.5.4

typo3 typo3 4.5.6

typo3 typo3 4.5.11

typo3 typo3 4.5.13

typo3 typo3 4.6.6

typo3 typo3 6.0

typo3 typo3 4.6.3

typo3 typo3 4.6.4

typo3 typo3 4.6.5

typo3 typo3 4.6.0

typo3 typo3 4.7

Vendor Advisories

Several remote vulnerabilities have been discovered in the TYPO3 web content management framework: CVE-2012-1606 Failing to properly HTML-encode user input in several places, the TYPO3 backend is susceptible to Cross-Site Scripting A valid backend user is required to exploit these vulnerabilities CVE-2012-1607 Accessing a CLI Script directl ...