TYPO3 Security Bulletin 20070716-1: Cross Site Scripting vulnerability in faq
Component Type: Third party extension. This extension is not part of the TYPO3 default installation
Affected Versions: Version 0.0.7 and all versions below
Vulnerability Type: Cross Site Scripting
Severity: medium
Problem Description: Failing to filter user input the extension is susceptible to cross site scripting (XSS) attacks, making it possible to execute arbitrary JavaScript.
Solution: An updated version is available from the TYPO3 extension manager and at
http://typo3.org/extensions/repository/view/faq/0.0.8/
General advice: Follow the recommendations that are given in the TYPO3 Security Cookbook.
Keep notice of the TYPO3 security bulletin page at http://typo3.org/teams/security/security-bulletins/.
Credits: Credits go to security team member Ekkehard Gümbel, who discovered the issue and author Markus Lange, who made a fixed version available.
