Component Type: Third party extension. This extension is not part of the TYPO3 default installation
Affected Versions: Version 0.0.7 and all versions below
Vulnerability Type: Cross Site Scripting
Severity: medium
Problem Description: Failing to filter user input the extension is susceptible to cross site scripting (XSS) attacks, making it possible to execute arbitrary JavaScript.
Solution: An updated version is available from the TYPO3 extension manager and at
typo3.org/extensions/repository/view/faq/0.0.8/
General advice: Follow the recommendations that are given in the <media 800 - external-link-new-window>TYPO3 Security Cookbook</media>.
Keep notice of the TYPO3 security bulletin page at typo3.org/teams/security/security-bulletins/.
Credits: Credits go to security team member Ekkehard Gümbel, who discovered the issue and author Markus Lange, who made a fixed version available.