CVE-2010-4890

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the Yet Another Calendar (ke_yac) extension for TYPO3 before version 1.1.2. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, as indicated in the extension repository [1]. The affected versions are all releases prior to 1.1.2.

Exploitation

An attacker can trigger the XSS by sending crafted input through unspecified vector(s) in the ke_yac extension. No authentication or special privileges are required for exploitation, as the vulnerability is accessible to remote unauthenticated users who can supply malicious payloads through these vectors [1].

Impact

Successful exploitation results in arbitrary web script or HTML execution in the context of the victim's browser. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites, depending on the attacker's payload and the user's privileges within the TYPO3 backend.

Mitigation

The vulnerability is fixed in version 1.1.2 of the ke_yac extension, available from the TYPO3 extension repository [1]. Users are advised to update to this version or later. No workarounds are provided in the available references.