{"id":"CVE-2018-6905","details":"The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.","aliases":["GHSA-3w22-wrwx-2r75"],"modified":"2026-08-27T08:14:50.112113Z","published":"2018-04-08T17:29:00.300Z","references":[{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1040755"},{"type":"FIX","url":"https://forge.typo3.org/issues/84191"},{"type":"EVIDENCE","url":"https://github.com/pradeepjairamani/TYPO3-XSS-POC"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/TYPO3/typo3","events":[{"introduced":"0"},{"fixed":"a12fcf718b166376aec739f5159583f7725ba1c7"},{"introduced":"41235ff8e38c6f3401df03ae8beddd62d662c525"},{"fixed":"a06e0787f1fb036e0549f026ce99f8cf610f2a9a"}],"database_specific":{"cpe":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.7.11"},{"introduced":"9.0.0"},{"fixed":"9.1.0"}],"source":"CPE_RANGE"}}],"versions":["v8.7.10","TYPO3_8-7-10","8.7.10","v9.0.0","v8.7.9","TYPO3_8-7-9","8.7.9","v8.7.8","TYPO3_8-7-8","8.7.8","v8.7.7","TYPO3_8-7-7","8.7.7","v8.7.6","TYPO3_8-7-6","8.7.6","v8.7.5","TYPO3_8-7-5","8.7.5","v8.7.4","TYPO3_8-7-4","8.7.4","TYPO3_8-7-2","8.7.2","TYPO3_8-7-1","8.7.1","TYPO3_8-7-0","8.7.0","TYPO3_8-6-0","8.6.0","TYPO3_8-5-0","8.5.0","TYPO3_8-4-0","8.4.0","TYPO3_8-3-0","8.3.0","TYPO3_8-2-0","8.2.0","TYPO3_8-1-0","8.1.0","TYPO3_8-0-0","8.0.0","TYPO3_7-6-2","7.6.2","TYPO3_7-6-1","7.6.1","TYPO3_7-6-0","7.6.0","TYPO3_7-5-0","7.5.0","TYPO3_7-4-0","7.4.0","TYPO3_7-3-0","7.3.0","TYPO3_7-2-0","7.2.0","TYPO3_7-1-0","7.1.0","TYPO3_7-0-0","7.0.0","TYPO3_6-2-3","6.2.3","TYPO3_6-2-2","6.2.2","TYPO3_6-2-1","6.2.1","TYPO3_6-2-0","6.2.0","TYPO3_6-2-0rc2","TYPO3_6-2-0rc1","TYPO3_6-2-0beta7","TYPO3_6-2-0beta6","TYPO3_6-2-0beta5","TYPO3_6-2-0beta4","TYPO3_6-2-0beta3","TYPO3_6-2-0beta2","TYPO3_6-2-0beta1","TYPO3_6-2-0alpha3","TYPO3_6-2-0alpha2","TYPO3_6-2-0alpha1","TYPO3_6-1-0rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6905.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/benjaminkott/bootstrap_package","events":[{"introduced":"63aeef44515fa3da60df1b90161d71efe8c0c433"},{"fixed":"65ee9ca8086148dbc0470dfe489c80122b646a08"}],"database_specific":{"cpe":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"9.0.0"},{"fixed":"9.1.0"}],"source":"CPE_RANGE"}}],"versions":["9.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6905.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/typo3/typo3","events":[{"introduced":"0"},{"fixed":"a12fcf718b166376aec739f5159583f7725ba1c7"},{"introduced":"41235ff8e38c6f3401df03ae8beddd62d662c525"},{"fixed":"a06e0787f1fb036e0549f026ce99f8cf610f2a9a"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.7.11"},{"introduced":"9.0.0"},{"fixed":"9.1.0"}]}}],"versions":["v8.7.10","TYPO3_8-7-10","8.7.10","v9.0.0","v8.7.9","TYPO3_8-7-9","8.7.9","v8.7.8","TYPO3_8-7-8","8.7.8","v8.7.7","TYPO3_8-7-7","8.7.7","v8.7.6","TYPO3_8-7-6","8.7.6","v8.7.5","TYPO3_8-7-5","8.7.5","v8.7.4","TYPO3_8-7-4","8.7.4","TYPO3_8-7-2","8.7.2","TYPO3_8-7-1","8.7.1","TYPO3_8-7-0","8.7.0","TYPO3_8-6-0","8.6.0","TYPO3_8-5-0","8.5.0","TYPO3_8-4-0","8.4.0","TYPO3_8-3-0","8.3.0","TYPO3_8-2-0","8.2.0","TYPO3_8-1-0","8.1.0","TYPO3_8-0-0","8.0.0","TYPO3_7-6-2","7.6.2","TYPO3_7-6-1","7.6.1","TYPO3_7-6-0","7.6.0","TYPO3_7-5-0","7.5.0","TYPO3_7-4-0","7.4.0","TYPO3_7-3-0","7.3.0","TYPO3_7-2-0","7.2.0","TYPO3_7-1-0","7.1.0","TYPO3_7-0-0","7.0.0","TYPO3_6-2-3","6.2.3","TYPO3_6-2-2","6.2.2","TYPO3_6-2-1","6.2.1","TYPO3_6-2-0","6.2.0","TYPO3_6-2-0rc2","TYPO3_6-2-0rc1","TYPO3_6-2-0beta7","TYPO3_6-2-0beta6","TYPO3_6-2-0beta5","TYPO3_6-2-0beta4","TYPO3_6-2-0beta3","TYPO3_6-2-0beta2","TYPO3_6-2-0beta1","TYPO3_6-2-0alpha3","TYPO3_6-2-0alpha2","TYPO3_6-2-0alpha1","TYPO3_6-1-0rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6905.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}]}