CVE-2020-15241

Description

TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).

How to fix CVE-2020-15241

To remediate CVE-2020-15241, upgrade the affected package to a fixed version below.

• —no fix listed
• —upgrade to 8.7.25 or later
• —upgrade to 8.7.25 or later
• —upgrade to 2.0.5 or later

Is CVE-2020-15241 being exploited?

Low — EPSS is 1.0%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• >= 8.7.25, <= 8.7.25, >= 9.5.6, <= 9.5.6
• >= 8.0.0, < 8.7.25
• >= 8.0.0, < 8.7.25
• >= 2.0.0, < 2.0.5

CVSS scores

References (8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-15241
• PATCHgithub.com/TYPO3/Fluid
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-15241.yaml
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-15241.yaml