GHSA-xgmx-j3hv-jh9x: 
PHP vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in TYPO3 CMS's link handling functionality, identified as TYPO3-CORE-SA-2019-022. The vulnerability affects TYPO3 versions 8.0.0-8.7.29, 9.0.0-9.5.11, and 10.0.0-10.2.0, and was disclosed on December 17, 2019. The issue impacts both t3:// URL handling and typolink functionality, affecting regular backend forms and frontend extensions that use typolink rendering (TYPO3 Advisory).

The vulnerability is classified as Medium severity with a CVSS v3.1 base score of 6.1. The CVSS vector string is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed, with low impact on both confidentiality and integrity, and no impact on availability (GitHub Advisory).

The vulnerability affects both backend forms and frontend extensions that utilize the typolink rendering functionality. When exploited, it could allow attackers to execute cross-site scripting attacks, potentially leading to unauthorized data access and modification (TYPO3 Advisory).

The vulnerability requires user interaction to be exploited but can be accessed remotely without requiring any privileges. The attack complexity is considered low, making it relatively straightforward to exploit once the conditions are met (GitHub Advisory).

Users are advised to update to the patched versions: TYPO3 8.7.30, 9.5.12, or 10.2.1. These versions contain the necessary security fixes to address the vulnerability. The fix includes proper encoding of typolink results to prevent XSS attacks (TYPO3 Advisory).