CVE-2020-15241
Cross-Site Scripting in TYPO3 Fluid Engine
TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross-Site Scripting in TYPO3 Fluid Engine
TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1).
- Record
CVE-2020-15241- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2020-1418
TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1).
- Record
EUVD-2020-1418- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7733-hjv6-4h47
Cross-Site Scripting in ternary conditional operator
Meta
- CVSS:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0)- CWE-79
:information_source: This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020
Problem
It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.
{showFullName ? fullName : defaultValue}
Solution
Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described.
Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases:
- TYPO3 v8.7.25 (using
typo3fluid/fluidv2.5.5) - TYPO3 v9.5.6 (using
typo3fluid/fluidv2.6.1)
Credits
Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.
References
- Record
GHSA-7733-hjv6-4h47- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79, CWE-601
- Updated
- 2026-11-02
NVD
TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1).
- Record
CVE-2020-15241- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-601, CWE-79
- Updated
- 2026-11-02
OSV
TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1).
- Record
CVE-2020-15241- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-7733-hjv6-4h47
Cross-Site Scripting in ternary conditional operator
Meta
- CVSS:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0)- CWE-79
:information_source: This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020
Problem
It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.
{showFullName ? fullName : defaultValue}
Solution
Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described.
Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases:
- TYPO3 v8.7.25 (using
typo3fluid/fluidv2.5.5) - TYPO3 v9.5.6 (using
typo3fluid/fluidv2.6.1)
Credits
Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.
References
- Record
GHSA-7733-hjv6-4h47- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601, CWE-79
- Updated
- 2026-11-02
OSVBIT-typo3-2020-15241 No score
TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1).
- Record
BIT-typo3-2020-15241- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3fluid/fluidPackagist |
2.0.0 up to 2.0.5 | 2.0.5 |
typo3fluid/fluidPackagist |
2.1.0 up to 2.1.4 | 2.1.4 |
typo3fluid/fluidPackagist |
2.2.0 up to 2.2.1 | 2.2.1 |
typo3fluid/fluidPackagist |
2.3.0 up to 2.3.5 | 2.3.5 |
typo3fluid/fluidPackagist |
2.4.0 up to 2.4.1 | 2.4.1 |
typo3fluid/fluidPackagist |
2.5.0 up to 2.5.5 | 2.5.5 |
typo3fluid/fluidPackagist |
2.6.0 up to 2.6.1 | 2.6.1 |
typo3/cms-corePackagist |
8.0.0 up to 8.7.25 | 8.7.25 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.6 | 9.5.6 |
typo3/cmsPackagist |
8.0.0 up to 8.7.25 | 8.7.25 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist |
9.0.0 up to 9.5.6 | 9.5.6 |
typo3Bitnami |
8.7.25 to 8.7.25, 9.5.6 to 9.5.6 | None known |
typo3fluid/fluidPackagist |
2.0.0 up to 2.0.5, plus listed versions 2.0.12.0.22.0.32.0.4 |
2.0.5 |
typo3fluid/fluidPackagist |
2.1.0 up to 2.1.4, plus listed versions 2.1.12.1.22.1.3 |
2.1.4 |
typo3fluid/fluidPackagist |
2.3.0 up to 2.3.5, plus listed versions 2.3.12.3.22.3.32.3.4 |
2.3.5 |
typo3fluid/fluidPackagist |
2.5.0 up to 2.5.5, plus listed versions 2.5.12.5.22.5.32.5.4 |
2.5.5 |
typo3/cms-corePackagist |
8.0.0 up to 8.7.25, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 13 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.7v8.7.8v8.7.9 |
8.7.25 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.6, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 10 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.2v9.5.3v9.5.4v9.5.5 |
9.5.6 |
typo3/cmsPackagist |
8.0.0 up to 8.7.25, plus listed versions 8.0.18.1.08.1.18.1.28.2.0 Show 34 moreShow less8.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.3v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9 |
8.7.25 |
typo3/cmsPackagist |
9.0.0 up to 9.5.6, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 10 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.2v9.5.3v9.5.4v9.5.5 |
9.5.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15241 is a medium vulnerability (CVSS 4.7) in Fluid-cloudnative Fluid, published October 8, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 61st percentile. Fixed in typo3fluid/fluid 2.0.5.
References
github.com/TYPO3/Fluid/security/advisories/GHSA-7733-hjv6-4h47
typo3.org/security/advisory/typo3-core-sa-2019-013
nvd.nist.gov/vuln/detail/CVE-2020-15241