Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2020-11065
CVE-2020-11065:
PHP vulnerability analysis and mitigation
Overview
A cross-site scripting (XSS) vulnerability was discovered in TYPO3 CMS versions greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2. The vulnerability was identified in the typolink functionality where link tags were not properly parsing properties assigned as HTML attributes (GitHub Advisory).
Technical details
The vulnerability is classified as CWE-79 (Cross-site Scripting) with a CVSS v3.1 score indicating moderate severity. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C) with low confidentiality and integrity impact (C:L, I:L) and no availability impact (A:N) (GitHub Advisory).
Impact
The vulnerability allows attackers to potentially execute cross-site scripting attacks through improperly parsed HTML attributes in link tags, which could lead to unauthorized data access or manipulation of web content (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been fixed in TYPO3 versions 9.5.17 and 10.4.2. Users are advised to update to these patched versions to mitigate the security risk (GitHub Advisory).
Community reactions
The vulnerability was responsibly disclosed by Josef Glatz and fixed by TYPO3 security team member Oliver Hader (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management