CVE-2023-38500
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
TYPO3 HTML Sanitizer, an HTML sanitizer tool, has an encoding issue in the serialization layer that allows malicious markup nested in a `noscript` element to be incorrectly encoded. Although `noscript` is disabled by default, it may be enabled in custom configurations, allowing bypassing of the XSS protection mechanism.
Risk Assessment
Organizations may be exposed to cross-site scripting attacks if `noscript` is enabled in their configuration, potentially leading to data theft or session hijacking.
Recommendation
It is recommended to update TYPO3 HTML Sanitizer to versions 1.5.1 or 2.1.2 to mitigate this vulnerability. Additionally, check the configuration to ensure that `noscript` is disabled if not needed.
Original NVD description (English source)
TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem.