CVE-2012-1608

CVE-2012-1608

EPSS 2.3%

The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.

Affected products

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://secunia.com/advisories/48647 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/http://www.debian.org/security/2012/dsa-2445 http://www.openwall.com/lists/oss-security/2012/03/30/4 http://www.osvdb.org/80762 http://www.securityfocus.com/bid/52771