Medium severity · published Nov 14, 2023
CVE-2023-47125
TYPO3 is an open source PHP based web content management system released under the GNU GPL
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
Html Sanitizer · Typo3
1.0.0 before 1.5.3; 2.0.0 before 2.1.4 · source: NVD
TY
Typo3 · Typo3
8.7.42 before 8.7.55; 9.5.29 before 9.5.44; 10.4.19 before 10.4.41; 11.3.2 before 11.5.33; 12.0.0 before 12.4.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-47125
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-47125
Patch
https://github.com/TYPO3/html-sanitizer/commit/b8f90717251d968c49dc77f8c1e5912e2fbe0dff
Vendor Advisory
https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-mm79-jhqm-9j54
Vendor Advisory
https://typo3.org/security/advisory/typo3-core-sa-2023-007
More from Html Sanitizer
6.1
CVE-2023-38500
TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values
6.1
CVE-2022-23499
HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values
6.1
CVE-2022-36020
The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values
5.1
CVE-2026-47345
TYPO3 HTML Sanitizer allows Cross-Site Scripting
2.1
CVE-2026-47344
TYPO3 HTML Sanitizer allows Cross-Site Scripting