CVE-2023-35783: 
PHP vulnerability analysis and mitigation

The ke_search (aka Faceted Search) extension for TYPO3 contains a Cross-Site Scripting (XSS) vulnerability that affects versions before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2. The vulnerability was disclosed on June 13, 2023, and has been assigned CVE-2023-35783 (TYPO3 Advisory).

The vulnerability stems from the extension's failure to properly encode user input in indexed data for output in HTML context. The issue has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

The vulnerability allows attackers to execute cross-site scripting attacks via indexed data, potentially leading to unauthorized access to sensitive information and manipulation of web content (TYPO3 Advisory).

The vulnerability has been patched in versions 4.0.3, 4.6.6, and 5.0.2. Users are advised to update to these versions as soon as possible. The updated versions are available through the TYPO3 extension manager, packagist, and the official TYPO3 extension repository (TYPO3 Advisory).