{"id":"CVE-2012-2112","aliases":["DEBIAN-CVE-2012-2112","DSA-2455-1","EUVD-2022-4961","GHSA-qfr3-29w6-hwpg"],"status":"published","title":"Typo3 Exception Handler XSS","description":"Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01387,"percentile":0.72404,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2012-04-20T00:00:00Z","modified":"2026-06-16T23:41:00Z","fixes":[{"ecosystem":"Packagist","package":"typo3/cms","fixed_in":["4.4.15","4.5.15","4.6.8"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:6.0","package":"typo3-src","fixed_in":["4.3.9+dfsg1-1+squeeze4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4"},{"fixed":"4.4.15"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5"},{"fixed":"4.5.15"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6"},{"fixed":"4.6.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7"},{"last_affected":"4.7"}]}],"versions":["4.7"]},{"source":"osv","ecosystem":"Debian:6.0","package":"typo3-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9+dfsg1-1+squeeze4"}]}],"versions":["4.3.9+dfsg1-1","4.3.9+dfsg1-1+squeeze1","4.3.9+dfsg1-1+squeeze2","4.3.9+dfsg1-1+squeeze3"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4"},{"fixed":"4.4.15"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5"},{"fixed":"4.5.15"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6"},{"fixed":"4.6.8"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","versions":["4.7"]}],"products":[{"vendor":"typo3","product":"typo3"}],"references":[{"url":"http://lists.typo3.org/pipermail/typo3-announce/2012/000241.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/74920","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/53047","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://lists.typo3.org/pipermail/typo3-announce/2012/000242.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2012/04/17/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2012/04/18/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.debian.org/security/2012/dsa-2455","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2112","tags":["advisory"]},{"url":"https://web.archive.org/web/20120421201555/http://www.securityfocus.com/bid/53047","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qfr3-29w6-hwpg"},{"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-2112","description":"Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.","status":"published","published":"2012-08-27T21:00:00Z","modified":"2024-08-06T19:26:07.612Z","updated_at":"2026-11-02T14:34:50.263482Z"}],"euvd":[{"id":"EUVD-2022-4961","description":"Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.","status":"published","published":"2012-08-27T21:00:00Z","modified":"2024-08-06T19:26:07Z","updated_at":"2026-11-03T01:56:15.412642Z"}],"ghsa":[{"id":"GHSA-qfr3-29w6-hwpg","title":"Typo3 Exception Handler XSS","description":"Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.","status":"published","published":"2022-05-17T01:46:40Z","modified":"2024-01-12T18:01:24Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:30.812736Z"}],"nvd":[{"id":"CVE-2012-2112","description":"Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.","status":"published","published":"2012-08-27T21:55:01.46Z","modified":"2026-06-16T23:41:00.953Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:15.643902Z"}],"osv":[{"id":"DSA-2455-1","title":"typo3-src - cross site scripting","status":"published","published":"2012-04-20T00:00:00Z","modified":"2026-03-09T01:22:54.731484Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"GHSA-qfr3-29w6-hwpg","title":"Typo3 Exception Handler XSS","description":"Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.","status":"published","published":"2022-05-17T01:46:40Z","modified":"2024-01-12T18:26:36.936187Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:54.40888Z"}]}}