CVE-2013-7074: TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component
3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.55749%
CWE
Published
5/17/2022
Updated
8/28/2023
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 4.5.0, <= 4.5.31 | 4.5.32 |
| typo3/cms | composer | >= 4.7.0, <= 4.7.16 | 4.7.17 |
| typo3/cms | composer | >= 6.0.0, <= 6.0.11 | 6.0.12 |
| typo3/cms | composer | >= 6.1.0, <= 6.1.6 | 6.1.7 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The provided vulnerability information (CVE-2013-7074) describes XSS in TYPO3's Content Editing Wizards due to improper input sanitization in unspecified parameters. However, the available data (advisories, NVD, mailing lists) does not explicitly name specific functions, file paths, or code snippets. The descriptions reference general components (e.g., 'Content Editing Wizards') and note that parameters were not properly encoded, but without commit diffs, patch details, or concrete code examples, identifying exact vulnerable functions with high confidence is impossible. TYPO3's security bulletin TYPO3-CORE-SA-2013-004 likely contains more specifics, but its contents are not fully disclosed in the provided sources.