CVE-2020-26229

LOW3.7EPSS 0.27%

XML External Entity in Dashboard Widget

發布日:2020/11/23修改日:2026/3/13

也稱為:GHSA-q9cp-mc96-m4w2BIT-typo3-2020-26229

描述

### Problem It has been discovered that RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with _libxml2_ version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. ### Solution Update to TYPO3 version 10.4.10 that fixes the problem described.

受影響套件(3)

Bitnami/typo3>= 10.0.0, < 10.4.10
Packagist/typo3/cms>= 10.0.0, < 10.4.10
Packagist/typo3/cms-core>= 10.0.0, < 10.4.10

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	LOW3.7	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-26229
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-26229.yaml
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-26229.yaml
WEBhttps://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-q9cp-mc96-m4w2
WEBhttps://typo3.org/security/advisory/typo3-core-sa-2020-012