CVE-2021-36787
Cross-site Scripting in the femanager TYPO3 extension
EPSS 1.3%
描述
The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website. Note: If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) to prevent upload of malicious SVG files or to set up a strict Content Security Policy for the destination folder of uploaded images.
如何修補 CVE-2021-36787
要修補 CVE-2021-36787,請將受影響套件升級到下列已修補版本。
- —升級至 5.5.1 或更新版本
CVE-2021-36787 正在被利用嗎?
低 — EPSS 為 1.3%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 5.5.1