GHSA-qmwf-j7g7-f5jw
Cross-Site Scripting in third party library mso/idna-convert
GHSA-qmwf-j7g7-f5jw is a vulnerability with no CVSS score yet in typo3/cms, published June 5, 2024. No source lists public exploit code. Fixed in typo3/cms 7.6.10.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
7.6.10typo3/cms +3 more
Description
Make sure to not expose the vendor directory to the publicly accessible document root. In composer managed installation, make sure to configure a dedicated web folder. In general it is recommended to not expose the complete typo3_src sources folder in the document root.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist | 7.6.0 up to 7.6.10 | 7.6.10 |
typo3/cmsPackagist | 8.0.0 up to 8.2.1 | 8.2.1 |
typo3/cmsPackagist | 7.6.0 up to 7.6.10, plus listed versions 7.6.17.6.27.6.37.6.47.6.5 Show 4 moreShow less7.6.67.6.77.6.87.6.9 | 7.6.10 |
typo3/cmsPackagist | 8.0.0 up to 8.2.1, plus listed versions 8.0.18.1.08.1.18.1.28.2.0 | 8.2.1 |
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in third party library mso/idna-convert
Make sure to not expose the vendor directory to the publicly accessible document root. In composer managed installation, make sure to configure a dedicated web folder. In general it is recommended to not expose the complete typo3_src sources folder in the document root.
- Record
GHSA-qmwf-j7g7-f5jw- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in third party library mso/idna-convert
Make sure to not expose the vendor directory to the publicly accessible document root. In composer managed installation, make sure to configure a dedicated web folder. In general it is recommended to not expose the complete typo3_src sources folder in the document root.
- Record
GHSA-qmwf-j7g7-f5jw- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.