Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

TYPO3's JavaScript Protection Fails to Block Certain Events

CVE-2012-3530 · published 14 years ago
Summary

Certain HTML5 events can be used to inject malicious code into TYPO3 websites, potentially allowing attackers to steal user data or take control of the site. This issue affects all versions of TYPO3 before 4.5.19, 4.6.12, and 4.7.4. To fix the issue, update to one of these patched versions or apply the relevant security patch.

What to do
  • Update typo3 cms to version 4.5.19.
  • Update typo3 cms to version 4.6.12.
  • Update typo3 cms to version 4.7.4.
Affected software
Ecosystem VendorProductAffected versions
composer typo3 cms >= 4.5, < 4.5.19
>= 4.6, < 4.6.12
>= 4.7, < 4.7.4
Fix: upgrade to 4.5.19
– typo3 typo3 4.5
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.5.10
26 more version ranges
cpe:2.3:a:typo3:typo3:4.5:*:*:*:*:*:*:*
Original advisory text
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site...
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
References
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published5 Sep 2012
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-94c2-g68f-9r98 · GHSA
CVE-2012-3530 · NVD
Track software like this
Free during beta