CVE-2020-11064: 
PHP vulnerability analysis and mitigation

In TYPO3 CMS versions greater than or equal to 9.0.0 and less than 9.5.17, and greater than or equal to 10.0.0 and less than 10.4.2, a cross-site scripting vulnerability was discovered in HTML placeholder attributes containing data of other database records. The vulnerability was disclosed on May 13, 2020, and requires a valid backend user account for exploitation (TYPO3 Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium), with an Impact Score of 2.7 and Exploitability Score of 2.3. The attack vector is Network-based (AV:N), with Low attack complexity (AC:L), requiring Low privileges (PR:L) and User interaction (UI:R). The scope is Changed (S:C), with Low impact on both Confidentiality (C:L) and Integrity (I:L), and No impact on Availability (A:N) (AttackerKB).

The vulnerability affects the confidentiality and integrity of the system with low severity, while having no impact on system availability. The cross-site scripting vulnerability could potentially allow attackers to execute malicious scripts in the context of other users' browser sessions (TYPO3 Advisory).

The vulnerability requires a valid backend user account to be exploited, which significantly limits its potential impact. The attack requires user interaction and low privileges for successful exploitation (TYPO3 Advisory).

The vulnerability has been fixed in TYPO3 versions 9.5.17 and 10.4.2. Users are advised to update to these patched versions to mitigate the risk (TYPO3 Advisory).

The vulnerability was reported by Florian Weiss and fixed by TYPO3 active contributor Markus Klein (TYPO3 Advisory).