CVE-2020-11065
Cross-Site Scripting in TYPO3 CMS
In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross-Site Scripting in TYPO3 CMS
In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.
- Record
CVE-2020-11065- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2020-0409
In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.
- Record
EUVD-2020-0409- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4j77-gg36-9864
Cross-Site Scripting in TYPO3 CMS Link Handling
It has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting - properties being assigned as HTML attributes have not been parsed correctly.
Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.
References
- Record
GHSA-4j77-gg36-9864- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.
- Record
CVE-2020-11065- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.
- Record
CVE-2020-11065- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-4j77-gg36-9864
Cross-Site Scripting in TYPO3 CMS Link Handling
It has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting - properties being assigned as HTML attributes have not been parsed correctly.
Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.
References
- Record
GHSA-4j77-gg36-9864- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-typo3-2020-11065 No score
In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.
- Record
BIT-typo3-2020-11065- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
10.0.0 up to 10.4.2 | 10.4.2 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.17 | 9.5.17 |
typo3/cmsPackagist |
10.0.0 up to 10.4.2 | 10.4.2 |
typo3/cmsPackagist |
9.0.0 up to 9.5.17 | 9.5.17 |
typo3Bitnami |
9.5.12 up to 9.5.17, 10.2.0 up to 10.4.2 | 9.5.1710.4.2 |
typo3/cms-corePackagist |
10.0.0 up to 10.4.2, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2v10.3.0v10.4.0v10.4.1 |
10.4.2 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.17, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 21 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.12v9.5.13v9.5.14v9.5.15v9.5.16v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.17 |
typo3/cmsPackagist |
10.0.0 up to 10.4.2, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2v10.3.0v10.4.0v10.4.1 |
10.4.2 |
typo3/cmsPackagist |
9.0.0 up to 9.5.17, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 21 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.12v9.5.13v9.5.14v9.5.15v9.5.16v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-11065 is a medium vulnerability (CVSS 5.4) in Typo3, published May 13, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in typo3/cms-core 10.4.2.
References
github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4j77-gg36-9864
nvd.nist.gov/vuln/detail/CVE-2020-11065
typo3.org/security/advisory/typo3-core-sa-2020-003