Every CVESearch/Get API key

GHSA-2rcw-9hrm-8q7q

TYPO3 Cross-Site Scripting in Frontend User Login

5.4 MediumFix available

Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile.

Template patterns that are affected are

  • ###FEUSER_[fieldName]### using system extension felogin

  • <!--###USERNAME###--> for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

What each source reports

GitHub Advisories Score used5.4

TYPO3 Cross-Site Scripting in Frontend User Login

Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile.

Template patterns that are affected are

  • ###FEUSER_[fieldName]### using system extension felogin

  • <!--###USERNAME###--> for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)

Record
GHSA-2rcw-9hrm-8q7q
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV5.4

TYPO3 Cross-Site Scripting in Frontend User Login

Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile.

Template patterns that are affected are

  • ###FEUSER_[fieldName]### using system extension felogin

  • <!--###USERNAME###--> for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)

Record
GHSA-2rcw-9hrm-8q7q
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
typo3/cms
Packagist
7.0.0 up to 7.6.32
7.6.32
typo3/cms
Packagist
8.0.0 up to 8.7.21
8.7.21
typo3/cms
Packagist
9.0.0 up to 9.5.2
9.5.2
typo3/cms
Packagist
7.0.0 up to 7.6.32, plus listed versions
7.0.17.0.27.1.07.2.07.3.0
Show 35 moreShow less
7.3.17.4.07.5.07.6.07.6.17.6.107.6.117.6.127.6.137.6.147.6.157.6.167.6.177.6.187.6.197.6.27.6.37.6.47.6.57.6.67.6.77.6.87.6.9v7.6.20v7.6.21v7.6.22v7.6.23v7.6.24v7.6.25v7.6.26v7.6.27v7.6.28v7.6.29v7.6.30v7.6.31
7.6.32
typo3/cms
Packagist
8.0.0 up to 8.7.21, plus listed versions
8.0.18.1.08.1.18.1.28.2.0
Show 30 moreShow less
8.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.3v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9
8.7.21
typo3/cms
Packagist
9.0.0 up to 9.5.2, plus listed versions
v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0
Show 6 moreShow less
v9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1
9.5.2

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-2rcw-9hrm-8q7q is a medium vulnerability (CVSS 5.4) in typo3/cms, published June 7, 2024. No source lists public exploit code. Fixed in typo3/cms 7.6.32.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open