TYPO3 CMS Cross-Site Scripting Vulnerability in Indexed Search

A cross-site scripting vulnerability has been identified in TYPO3 CMS versions 13.0.0 prior to 13.4.31 and 14.0.0 prior to 14.3.2. Editors with the ability to create or modify page content could include unfiltered HTML in page titles. These titles were then stored in the search index and, when displayed in the frontend search results through the Indexed Search plugin, were rendered without proper output encoding. This lack of sanitization allowed for the injection of malicious scripts.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users are advised to update TYPO3 to versions 13.4.31 LTS or 14.3.3 LTS, which address this vulnerability.