CVE-2011-4903

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
TYPO3	TYPO3	before 4.5.4

References

https://security-tracker.debian.org/tracker/CVE-2011-4903Third Party Advisory
https://typo3.org/security/advisory/typo3-core-sa-2011-001/#XSSVendor Advisory
https://security-tracker.debian.org/tracker/CVE-2011-4903Third Party Advisory
https://typo3.org/security/advisory/typo3-core-sa-2011-001/#XSSVendor Advisory

Timeline

Published: Nov 6, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-49046.5TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve CVE-2011-49055.0Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by s CVE-2011-49069.8Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.CVE-2011-49075.3Joomla! 1.5x through 1.5.12: Missing JEXEC Check CVE-2011-49089.8TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.CVE-2011-49094.3Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.5.12 allow remote attackers to inject arbitrary web script or HTML v CVE-2011-49104.3Cross-site scripting (XSS) vulnerability in Joomla! before 1.5.12 allows remote attackers to inject arbitrary web script or HTML via the PAT CVE-2011-49115.0Joomla! before 1.5.12 does not perform a JEXEC check in unspecified files, which allows remote attackers to obtain the installation path via CVE-2011-49125.3Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.CVE-2011-49137.8The rose_parse_ccitt function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 does not validate the FAC_CCITT_DEST_NSAP and FAC_CC CVE-2011-49146.4The ROSE protocol implementation in the Linux kernel before 2.6.39 does not verify that certain data-length values are consistent with the a CVE-2011-49155.5fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /proc/interrupts.