-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 4.5.0, < 4.5.39 | 4.5.39 |
| typo3/cms | composer | >= 4.6.0, < 6.2.9 | 6.2.9 |
| typo3/cms | composer | >= 7.0.0, < 7.0.2 | 7.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of anchor links when 'config.prefixLocalAnchors' is enabled without 'config.absRefPrefix'. The ContentObjectRenderer::typoLink function is directly responsible for URL generation and would apply the vulnerable prefix logic. PageGenerator::renderContentWithHeader manages overall page rendering context where this misconfiguration could be exploited. Both are core components of TYPO3's frontend rendering pipeline where URL manipulation would occur. Confidence is high for typoLink due to its direct role in link processing, and medium for PageGenerator due to broader contextual involvement.