GHSA-95qm-3xp7-vfj5: 
PHP vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in TYPO3 CMS's Form Framework validation handling, identified as GHSA-95qm-3xp7-vfj5. The vulnerability was disclosed on December 17, 2019, affecting TYPO3 CMS versions 8.0.0-8.7.29, 9.0.0-9.5.11, and 10.0.0-10.2.0. The issue was specifically located in the Form Framework (ext:form) subcomponent of TYPO3 CMS (TYPO3 Advisory).

The vulnerability has been classified as moderate severity with a CVSS v3.1 base score of 6.1. The CVSS vector string is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed, with low impacts on both confidentiality and integrity, and no impact on availability (GitHub Advisory).

The vulnerability allows attackers to perform cross-site scripting attacks through the output of field validation errors in the Form Framework. This could potentially lead to unauthorized data access and modification when successfully exploited (TYPO3 Advisory).

The vulnerability requires user interaction to be exploited and can be accessed over the network. No specific instances of exploitation in the wild were reported in the available sources (GitHub Advisory).

Users are advised to update to the patched versions: TYPO3 8.7.30, 9.5.12, or 10.2.1. The fix was implemented by TYPO3 framework merger Frank Nägler. Users are also recommended to follow the security guidelines provided in the TYPO3 Security Guide and subscribe to the typo3-announce mailing list for future security updates (TYPO3 Advisory).