{
"id": "GHSA-75mx-chcf-2q32",
"aliases": [],
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-j5v7-9xr5-m7gx. This link is maintained to preserve external references.\n\n## Original Description\n\nAll link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized editors can insert javascript commands by using the url scheme `javascript:`.",
"summary": "Duplicate Advisory: TYPO3 Cross-Site Scripting vulnerability in typolinks",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.2.16"
}
]
}
],
"package": {
"name": "typo3/cms",
"ecosystem": "Packagist"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.6.1"
}
]
}
],
"package": {
"name": "typo3/cms",
"ecosystem": "Packagist"
}
}
],
"modified": "2026-02-03T17:54:27Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"published": "2024-05-30T21:25:26Z",
"withdrawn": "2026-02-03T17:54:27Z",
"references": [
{
"url": "https://github.com/TYPO3/typo3/commit/25a1473907f0f4b2bb0147c661981940c57a4555",
"type": "WEB"
},
{
"url": "https://github.com/TYPO3/typo3/commit/de1755a6dcff9b037c6d5a1fa340ba100aff054a",
"type": "WEB"
},
{
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2015-12-15-2.yaml",
"type": "WEB"
},
{
"url": "https://github.com/TYPO3/typo3",
"type": "PACKAGE"
},
{
"url": "https://typo3.org/security/advisory/typo3-core-sa-2015-012",
"type": "WEB"
},
{
"url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2024-05-30T21:25:26Z"
}
}