CVE-2008-6687

Vulnerability

Cross-site scripting (XSS) vulnerability exists in the DCD GoogleMap (dcdgooglemap) extension version 1.1.0 and earlier for TYPO3. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unknown vectors [1]. The exact parameter or input that triggers the XSS is not detailed in the available references.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL or input that, when processed by the vulnerable extension, executes arbitrary JavaScript in the context of the victim's browser. No authentication is required, as the vulnerability can be triggered by a remote attacker without prior access [1]. The exploitation is likely achieved by tricking a user into clicking a specially crafted link or visiting a page containing the malicious payload.

Impact

Successful exploitation allows an attacker to perform cross-site scripting attacks, leading to information disclosure, session hijacking, or defacement within the TYPO3 website. The attacker can execute arbitrary web script or HTML in the victim's browser, potentially compromising the integrity and confidentiality of the user's session [1].

Mitigation

The vulnerability is fixed in version 1.1.1 of the dcdgooglemap extension [1]. Administrators should update the extension to version 1.1.1 or later immediately. No workarounds are described in the available reference. There is no indication that this CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.