typo3.org: TYPO3 Security Bulletin 20060911-1: indexed search

Home . Teams . Security . Security Bulletins . TYPO3-20060911-1

Teams

Security Bulletins

TYPO3.org

TYPO3 Security Bulletin TYPO3-20060911-1: indexed search

Component Type: System Extension
This Extension is Part of the TYPO3 default installation

Affected Components: Indexed Search

Versions: 2.9.0 under TYPO3 4.x

Vulnerability Type: Cross Site Scripting

Severity: medium

Problem Description:
The search word was not escaped correctly so a prepared URL (e.g. referenced in an email) could potentially contain some unwanted JavaScript code.

Solution:
Upgrade to TYPO3 4.0.2 or apply the Patch which is provided here: Initiates file download indexed search xss patch

Credits:
Special thanks to Mr. Ekkehard Gümbel who pointed this one out to us, and to Mr. Ingmar Schlecht, who provided the Patch.