CVE-2009-3633
TYPO3 API function vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing algorithm.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing algorithm.
- Record
CVE-2009-3633- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing algorithm.
- Record
CVE-2009-3633- Updated
- 2026-11-02
EUVDEUVD-2022-4515 No score
Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing algorithm.
- Record
EUVD-2022-4515- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m7rg-85g8-28m9 No score
TYPO3 API function vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing algorithm.
- Record
GHSA-m7rg-85g8-28m9- Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-m7rg-85g8-28m9 No score
TYPO3 API function vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing algorithm.
- Record
GHSA-m7rg-85g8-28m9- Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
through 4.0.13 | None known |
typo3/cms-corePackagist |
4.1.0 up to 4.1.13 | 4.1.13 |
typo3/cms-corePackagist |
4.2.0 up to 4.2.10 | 4.2.10 |
typo3/cms-corePackagist |
4.3alpha1 up to 4.3beta2 | 4.3beta2 |
typo3-srcDebian:4.0 From an advisory covering 9 CVEs |
before 4.0.2+debian-9 | 4.0.2+debian-9 |
typo3-srcDebian:5.0 From an advisory covering 9 CVEs |
before 4.2.5-1+lenny2, plus listed versions 4.2.5-14.2.5-1+lenny1 |
4.2.5-1+lenny2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3633 is a medium vulnerability (CVSS 4.3) in Typo3, published November 2, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in typo3/cms-core 4.1.13.
References
typo3.org/teams/security/security-bulletins/typo3-sa-2009-016
secunia.com/advisories/37122
exchange.xforce.ibmcloud.com/vulnerabilities/53925
marc.info?l=oss-security&m=125633199111438&w=2
vupen.com/english/advisories/2009/3009
Show 8 moreShow less
securityfocus.com/bid/36801
nvd.nist.gov/vuln/detail/CVE-2009-3633
github.com/TYPO3/typo3/commit/51f3dd9804cae04575323b92a9136e5a511fe810
web.archive.org/web/20101223093042/http://www.securityfocus.com/bid/36801