{"id":"CVE-2018-6905","aliases":["EUVD-2022-2249","GHSA-3w22-wrwx-2r75"],"status":"published","title":"Typo3 XSS Vulnerability","description":"The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.","severity":{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02171,"percentile":0.82407,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2018-04-08T17:00:00Z","modified":"2026-10-24T10:30:46Z","exploits":[{"source":"pocgithub","id":"dnr6419/CVE-2018-6905","title":"dnr6419/CVE-2018-6905","date":"2021-06-02","url":"https://github.com/dnr6419/CVE-2018-6905"},{"source":"pocgithub","id":"pradeepjairamani/TYPO3-XSS-POC","title":"pradeepjairamani/TYPO3-XSS-POC","date":"2018-04-08","url":"https://github.com/pradeepjairamani/TYPO3-XSS-POC"}],"fixes":[{"ecosystem":"Packagist","package":"typo3/cms","fixed_in":["9.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0"}]}],"versions":["6.2.0","6.2.1","6.2.10","6.2.10-rc1","6.2.11","6.2.12","6.2.13","6.2.14","6.2.15","6.2.16","6.2.17","6.2.18","6.2.19","6.2.2","6.2.20","6.2.21","6.2.22","6.2.23","6.2.24","6.2.25","6.2.26","6.2.27","6.2.28","6.2.29","6.2.3","6.2.30","6.2.31","6.2.4","6.2.5","6.2.6","6.2.7","6.2.8","6.2.9","7.0.0","7.0.1","7.0.2","7.1.0","7.2.0","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.6.1","7.6.10","7.6.11","7.6.12","7.6.13","7.6.14","7.6.15","7.6.16","7.6.17","7.6.18","7.6.19","7.6.2","7.6.3","7.6.4","7.6.5","7.6.6","7.6.7","7.6.8","7.6.9","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.2.1","8.3.0","8.3.1","8.4.0","8.4.1","8.5.0","8.5.1","8.6.0","8.6.1","8.7.0","8.7.1","8.7.2","v7.6.20","v7.6.21","v7.6.22","v7.6.23","v7.6.24","v7.6.25","v7.6.26","v7.6.27","v7.6.28","v7.6.29","v7.6.30","v7.6.31","v7.6.32","v8.7.10","v8.7.11","v8.7.12","v8.7.13","v8.7.14","v8.7.15","v8.7.16","v8.7.17","v8.7.18","v8.7.19","v8.7.20","v8.7.21","v8.7.22","v8.7.23","v8.7.24","v8.7.25","v8.7.26","v8.7.27","v8.7.28","v8.7.29","v8.7.3","v8.7.30","v8.7.31","v8.7.32","v8.7.4","v8.7.5","v8.7.6","v8.7.7","v8.7.8","v8.7.9","v9.0.0","v9.1.0"]}],"products":[{"vendor":"typo3","product":"typo3"}],"references":[{"url":"https://forge.typo3.org/issues/84191","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"http://www.securitytracker.com/id/1040755","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://github.com/pradeepjairamani/TYPO3-XSS-POC","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6905","tags":["advisory"]},{"url":"https://github.com/TYPO3/typo3/commit/d2c0ea7db3b31a796a82f9d39f77f9983beb7c35","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3w22-wrwx-2r75"}],"sources":{"cve":[{"id":"CVE-2018-6905","description":"The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.","status":"published","published":"2018-04-08T17:00:00Z","modified":"2024-08-05T06:17:17.192Z","updated_at":"2026-11-02T14:35:05.619113Z"}],"euvd":[{"id":"EUVD-2022-2249","description":"The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.","status":"published","published":"2018-04-08T17:00:00Z","modified":"2024-08-05T06:17:17Z","updated_at":"2026-11-03T02:40:06.682302Z"}],"ghsa":[{"id":"GHSA-3w22-wrwx-2r75","title":"Typo3 XSS Vulnerability","description":"The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a crafted site name during the installation process.","status":"published","published":"2022-05-14T03:25:24Z","modified":"2023-09-21T09:52:43Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:06.234371Z"}],"nvd":[{"id":"CVE-2018-6905","description":"The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.","status":"published","published":"2018-04-08T17:29:00.3Z","modified":"2026-06-17T02:02:26.153Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"CVE-2018-6905","description":"The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.","status":"published","published":"2018-04-08T17:29:00.3Z","modified":"2026-10-24T10:30:46.74373601Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"GHSA-3w22-wrwx-2r75","title":"Typo3 XSS Vulnerability","description":"The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a crafted site name during the installation process.","status":"published","published":"2022-05-14T03:25:24Z","modified":"2024-02-16T08:19:44.115724Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:36.092962Z"}]}}