CVE-2025-30083 json
Additional TCA Allows Cross-Site Scripting (XSS)
published 2025-03-19 19 mo ago modified 2025-03-19 19 mo ago also GHSA-rrh3-cgmx-w62f
- cvss
- 5.5
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
A cross-site scripting (XSS) vulnerability has been discovered in the Additional TCA extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 1.15.17 and 1.16.9 are available for download.
Patch / fix
- packagist codingms/additional-tca 1.15.17, 1.16.9
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | codingms/additional-tca | >=1.16.0, <1.16.9 >=1.7.0, <1.15.17 |
1.16.9 1.15.17 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
Sources
- GitHub Advisory GHSA-rrh3-cgmx-w62f
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.