Typo3 v4.x: XSS in extension "Indexed Search" v2.9.0

CVE	Category	Price	Severity
CVE-2007-4256	CWE-79	$500	High

Author	Risk	Exploitation Type	Date
Unknown	High	Remote	2006-10-03

CPE
cpe:cpe:/a:typo3:typo3:4.x

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2006100012

Below is a copy:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

There's a XSS issue in the 'Indexed search' extension 2.9.0 for Typo3.
This extension is part of a default Typo3 4.0.x installlation.

Typo3 4.0.2 fixes it.

http://typo3.org/teams/security/security-bulletins/typo3-20060911-1/

Credits go to Mr. Ekkehard GÃ¼mbel (discovery) and Mr. Ingmar Schlecht
(patch).

This is rather old, dating back to september 11th. Unfortunately Typo3
advisories rarely end up here.
http://typo3.org/teams/security/security-bulletins/

Moritz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFF7qMn6GkvSd/BgwRAoNkAJ0aT/fKl7juL2J/BMu/R6agJqxykwCdGqc8
Mufef7E2mYQKUgFibpnoKbs=
=CWLZ
-----END PGP SIGNATURE-----

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum