GHSA-4542-p56h-8xww
Cross-Site Scripting (XSS) vulnerabilities in Neos
GHSA-4542-p56h-8xww is a vulnerability with no CVSS score yet in typo3/neos, published June 5, 2024. No source lists public exploit code. Fixed in typo3/neos 1.2.13.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.2.13typo3/neos +3 more
Description
It has been discovered that Neos is vulnerable to several XSS attacks. Through these vulnerabilities, an attacker could tamper with page rendering, redirect victims to a fake login page, or capture user credentials (such as cookies). With the potential backdoor upload an attacker could gain access to the server itself, to an extent mainly limited by the server setup.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/neosPackagist | 1.2.0 up to 1.2.13 | 1.2.13 |
typo3/neosPackagist | 2.0.0 up to 2.0.4 | 2.0.4 |
typo3/neosPackagist | 1.2.0 up to 1.2.13, plus listed versions 1.2.11.2.101.2.111.2.121.2.2 Show 7 moreShow less1.2.31.2.41.2.51.2.61.2.71.2.81.2.9 | 1.2.13 |
typo3/neosPackagist | 2.0.0 up to 2.0.4, plus listed versions 2.0.12.0.22.0.3 | 2.0.4 |
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting (XSS) vulnerabilities in Neos
It has been discovered that Neos is vulnerable to several XSS attacks. Through these vulnerabilities, an attacker could tamper with page rendering, redirect victims to a fake login page, or capture user credentials (such as cookies). With the potential backdoor upload an attacker could gain access to the server itself, to an extent mainly limited by the server setup.
- Record
GHSA-4542-p56h-8xww- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting (XSS) vulnerabilities in Neos
It has been discovered that Neos is vulnerable to several XSS attacks. Through these vulnerabilities, an attacker could tamper with page rendering, redirect victims to a fake login page, or capture user credentials (such as cookies). With the potential backdoor upload an attacker could gain access to the server itself, to an extent mainly limited by the server setup.
- Record
GHSA-4542-p56h-8xww- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.