CVE-2009-0816
Typo3 Backend XSS Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
- Record
CVE-2009-0816- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
- Record
CVE-2009-0816- Updated
- 2026-11-02
EUVDEUVD-2022-4356 No score
Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
- Record
EUVD-2022-4356- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jg55-3q6h-2ccf No score
Typo3 Backend XSS Vulnerability
An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided files, allows a remote attacker to read arbitrary files on a host.
The expected value of a mandatory hash secret, intended to invalidate such requests, is exposed to remote users allowing them to bypass access control by providing the correct value.
There's no authentication required to exploit this vulnerability. The vulnerability allows to read any file, the web server user account has access to.
- Record
GHSA-jg55-3q6h-2ccf- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-jg55-3q6h-2ccf No score
Typo3 Backend XSS Vulnerability
An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided files, allows a remote attacker to read arbitrary files on a host.
The expected value of a mandatory hash secret, intended to invalidate such requests, is exposed to remote users allowing them to bypass access control by providing the correct value.
There's no authentication required to exploit this vulnerability. The vulnerability allows to read any file, the web server user account has access to.
- Record
GHSA-jg55-3q6h-2ccf- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist |
3.3.0 up to 3.9.0 | 3.9.0 |
typo3/cmsPackagist |
4.0 up to 4.0.12 | 4.0.12 |
typo3/cmsPackagist |
4.1.0 up to 4.1.10 | 4.1.10 |
typo3/cmsPackagist |
4.2.0 up to 4.2.6 | 4.2.6 |
typo3/cmsPackagist |
4.3alpha1 to 4.3alpha1 | None known |
typo3-srcDebian:5.0 From an advisory covering 2 CVEs |
before 4.2.5-1+lenny1, plus listed versions 4.2.5-1 |
4.2.5-1+lenny1 |
typo3/cmsPackagist |
3.3.0 and later, plus listed versions 6.2.06.2.16.2.106.2.10-rc16.2.11 Show 45 moreShow less6.2.126.2.136.2.146.2.156.2.166.2.176.2.186.2.196.2.26.2.206.2.216.2.226.2.236.2.246.2.256.2.266.2.276.2.286.2.296.2.36.2.306.2.316.2.46.2.56.2.66.2.76.2.86.2.97.0.07.0.17.0.27.1.07.2.07.3.07.3.17.4.07.5.07.6.07.6.17.6.107.6.117.6.127.6.137.6.147.6.15 |
None known |
typo3/cmsPackagist |
Listed versions 4.3alpha1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0816 is a medium vulnerability (CVSS 4.3) in Typo3, published February 10, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in typo3/cms 3.9.0.
References
openwall.com/lists/oss-security/2009/02/10/6
debian.org/security/2009/dsa-1720
securitytracker.com/id?1021709
typo3.org/teams/security/security-bulletins/typo3-sa-2009-002
nvd.nist.gov/vuln/detail/CVE-2009-0816
web.archive.org/web/20210507104956/http://www.securitytracker.com/id?1021709
github.com/advisories/GHSA-jg55-3q6h-2ccf
Left out here: 320 versions. The JSON record has them.