Miggo Logo
Miggo Vulnerability Database
→
CVE-2012-6148

CVE-2012-6148: Typo3 Function Menu API XSS Vulnerability

3.5

CVSS Score

Basic Information

CVE ID
CVE-2012-6148
GHSA ID
GHSA-rgf6-9q7g-55qg
EPSS Score
0.45163%
CWE
CWE-79
Published
5/17/2022
Updated
1/12/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
AV:N/AC:M/Au:S/C:N/I:P/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
typo3/cmscomposer>= 4.5.0, < 4.5.214.5.21
typo3/cmscomposer>= 4.6.0, < 4.6.144.6.14
typo3/cmscomposer>= 4.7.0, < 4.7.64.7.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability explicitly references the function menu() API as the source of XSS. TYPO3's security bulletin (SA-2012-005) states that the function menu() API lacked proper input encoding. The ModuleMenu class is central to backend menu generation in TYPO3, and methods like generateFunctionMenu would handle rendering menu items. While exact code isn't provided, the component and vulnerability type align with insufficient output encoding in menu rendering logic. The confidence is high due to the direct match between the described API and TYPO3's core backend structure.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ross-sit* s*riptin* (XSS) vuln*r**ility in t** *un*tion m*nu *PI in TYPO* *.*.x ***or* *.*.**, *.*.x ***or* *.*.**, *n* *.*.x ***or* *.*.* *llows r*mot* *ut**nti**t** ***k*n* us*rs to inj**t *r*itr*ry w** s*ript or *TML vi* unsp**i*i** v**tors.

Reasoning

T** vuln*r**ility *xpli*itly r***r*n**s t** *un*tion `m*nu()` *PI *s t** sour** o* XSS. TYPO*'s s**urity *ull*tin (S*-****-***) st*t*s t**t t** *un*tion `m*nu()` *PI l**k** prop*r input *n*o*in*. T** `Mo*ul*M*nu` *l*ss is **ntr*l to ***k*n* m*nu **n*