Moderate severityNVD Advisory· Published Oct 8, 2020· Updated Aug 4, 2024
Cross-Site Scripting in TYPO3 Fluid Engine
CVE-2020-15241
Description
TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
typo3fluid/fluidPackagist | >= 2.0.0, < 2.0.5 | 2.0.5 |
typo3fluid/fluidPackagist | >= 2.1.0, < 2.1.4 | 2.1.4 |
typo3fluid/fluidPackagist | >= 2.2.0, < 2.2.1 | 2.2.1 |
typo3fluid/fluidPackagist | >= 2.3.0, < 2.3.5 | 2.3.5 |
typo3fluid/fluidPackagist | >= 2.4.0, < 2.4.1 | 2.4.1 |
typo3fluid/fluidPackagist | >= 2.5.0, < 2.5.5 | 2.5.5 |
typo3fluid/fluidPackagist | >= 2.6.0, < 2.6.1 | 2.6.1 |
typo3/cms-corePackagist | >= 8.0.0, < 8.7.25 | 8.7.25 |
typo3/cms-corePackagist | >= 9.0.0, < 9.5.6 | 9.5.6 |
typo3/cmsPackagist | >= 8.0.0, < 8.7.25 | 8.7.25 |
typo3/cmsPackagist | >= 9.0.0, < 9.5.6 | 9.5.6 |
Affected products
5- osv-coords4 versions
>= 8.7.25, <= 8.7.25+ 3 more
- (no CPE)range: >= 8.7.25, <= 8.7.25
- (no CPE)range: >= 8.0.0, < 8.7.25
- (no CPE)range: >= 8.0.0, < 8.7.25
- (no CPE)range: >= 2.0.0, < 2.0.5
- TYPO3/Fluidv5Range: >= 2.0.0, < 2.0.5
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-7733-hjv6-4h47ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-15241ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-15241.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-15241.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3fluid/fluid/CVE-2020-15241.yamlghsaWEB
- github.com/TYPO3/Fluid/commit/9ef6a8ffff2e812025fc0701b4ce72eea6911a3dghsax_refsource_MISCWEB
- github.com/TYPO3/Fluid/security/advisories/GHSA-7733-hjv6-4h47ghsax_refsource_CONFIRMWEB
- typo3.org/security/advisory/typo3-core-sa-2019-013ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.