GHSA-6xwf-7rfm-4gwc: 
PHP vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in TYPO3 CMS's Filelist Module, identified as TYPO3-CORE-SA-2019-023, disclosed on December 17, 2019. The vulnerability affects TYPO3 CMS versions 8.0.0-8.7.29, 9.0.0-9.5.11, and 10.0.0-10.2.0 (TYPO3 Advisory).

The vulnerability exists in the output table listing of the 'Files' backend module, where file extensions containing malicious sequences could trigger cross-site scripting. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Moderate severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (GitHub Advisory).

The vulnerability could lead to unauthorized data access and potential data modification through cross-site scripting attacks. The impact is characterized by low confidentiality and integrity breaches, with no impact on system availability (GitHub Advisory).

Exploitation of this vulnerability requires access to the file system of the server, either directly or through synchronization. The attack complexity is considered low, requiring no privileges but does need user interaction (TYPO3 Advisory).

The vulnerability has been patched in TYPO3 versions 8.7.30, 9.5.12, and 10.2.1. Users are advised to update to these patched versions to resolve the security issue. The fix was implemented by TYPO3 framework merger Andreas Fernandez (TYPO3 Advisory).

The vulnerability was initially reported by zimmer7 GmbH, demonstrating active security research involvement in the TYPO3 community (TYPO3 Advisory).