Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-8091

CVE-2020-8091:
Typo3 Cross-Site Scripting in Flash component (ELTS)

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-8091
GHSA ID
GHSA-qvhv-pwww-53jj
EPSS Score
0.95348%
CWE
CWE-79
Published
5/24/2022
Updated
9/30/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
typo3/cmscomposer>= 6.2.0, <= 6.2.386.2.39
typo3/cmscomposer>= 7.0.0, <= 7.1.07.2.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from the third-party 'websvg' component (svg.swf) which handled SVG rendering via Flash. The PHP methods PageRenderer::loadSvg() and ScalableVectorGraphicsContentObject::render() were entry points that enabled loading this vulnerable component. The commit removed these integration points and the component itself, confirming their role in the attack surface. While the XSS execution occurred in the Flash component, these PHP functions facilitated its inclusion.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

TYPO* *.*.* to *.*.** *LTS *n* *.*.* to *.*.* in*lu*** * vuln*r**l* *xt*rn*l *ompon*nt, w*i** *oul* *llow *n un*ut**nti**t**, r*mot* *tt**k*r to *on*u*t * *ross-sit* s*riptin* (XSS) *tt**k on * t*r**t** syst*m.

Reasoning

T** vuln*r**ility st*mm** *rom t** t*ir*-p*rty 'w**sv*' *ompon*nt (`sv*.sw*`) w*i** **n*l** SV* r*n**rin* vi* *l*s*. T** `P*P` m*t*o*s `P***R*n**r*r::lo**Sv*()` *n* `S**l**l*V**tor*r*p*i*s*ont*ntO*j**t::r*n**r()` w*r* *ntry points t**t *n**l** lo**in