CVE-2012-1608
Typo3 API XSS Vulnerabilities
The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
Exploit likelihood
What each source reports
NVD Score used
The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
- Record
CVE-2012-1608- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
- Record
CVE-2012-1608- Updated
- 2026-11-02
EUVDEUVD-2022-5487 No score
The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
- Record
EUVD-2022-5487- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w3v6-r62r-fvqh No score
Typo3 API XSS Vulnerabilities
The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
- Record
GHSA-w3v6-r62r-fvqh- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-w3v6-r62r-fvqh No score
Typo3 API XSS Vulnerabilities
The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
- Record
GHSA-w3v6-r62r-fvqh- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-1608 No score
The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
- Record
UBUNTU-CVE-2012-1608- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist |
4.4.0 to 4.4.13 | 4.4.14 |
typo3/cmsPackagist |
4.5.0 to 4.5.13 | 4.5.14 |
typo3/cmsPackagist |
4.6.0 to 4.6.6 | 4.6.7 |
typo3-srcDebian:6.0 From an advisory covering 3 CVEs |
before 4.3.9+dfsg1-1+squeeze3, plus listed versions 4.3.9+dfsg1-14.3.9+dfsg1-1+squeeze14.3.9+dfsg1-1+squeeze2 |
4.3.9+dfsg1-1+squeeze3 |
typo3/cmsPackagist |
4.4.0 up to 4.4.14 | 4.4.14 |
typo3/cmsPackagist |
4.5.0 up to 4.5.14 | 4.5.14 |
typo3/cmsPackagist |
4.6.0 up to 4.6.7 | 4.6.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-1608 is a medium vulnerability (CVSS 5.0) in Typo3, published March 31, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.30%, the 83rd percentile. Fixed in typo3/cms 4.4.14.