GHSA-76r3-m635-p3vc: 
PHP vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in TYPO3 CMS's language pack handling component within the install tool. The vulnerability was identified on January 22, 2019, affecting TYPO3 versions 9.2.0 through 9.5.3. This security issue was tracked as GHSA-76r3-m635-p3vc and was assigned a moderate severity rating (TYPO3 Advisory).

The vulnerability stems from improper encoding of information from external sources in the language pack handling functionality of the install tool. The issue has been assigned a CVSS v3.1 base score of 6.1 (Moderate), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79, which is a common weakness enumeration for Cross-Site Scripting (GitHub Advisory).

The vulnerability could potentially lead to cross-site scripting attacks, resulting in unauthorized access to sensitive information and possible manipulation of web content. The CVSS metrics indicate low impact on both confidentiality and integrity, with no impact on availability (TYPO3 Advisory).

The vulnerability requires network access and user interaction to be exploited, but no privileges are required. The attack complexity is considered low, making it relatively straightforward to exploit if unpatched (GitHub Advisory).

The vulnerability was patched in TYPO3 version 9.5.4. Users are strongly advised to update to this version or later to address the security issue. The fix was implemented by TYPO3 core team member Frank Nägler (TYPO3 Advisory).

The vulnerability was responsibly disclosed by TYPO3 core team member Georg Ringer, demonstrating the project's commitment to security through internal security review processes (TYPO3 Advisory).