{"id":"CVE-2020-15241","details":"TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).","aliases":["BIT-typo3-2020-15241","GHSA-7733-hjv6-4h47"],"modified":"2026-08-27T03:49:10.097942786Z","published":"2020-10-08T21:15:10.167Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:typo3:typo3:8.7.25:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.7.25"},{"last_affected":"8.7.25"}],"source":"CPE_STRING","vendor_product":"typo3:typo3"}]},"references":[{"type":"FIX","url":"https://github.com/TYPO3/Fluid/commit/9ef6a8ffff2e812025fc0701b4ce72eea6911a3d"},{"type":"EVIDENCE","url":"https://github.com/TYPO3/Fluid/security/advisories/GHSA-7733-hjv6-4h47"},{"type":"EVIDENCE","url":"https://typo3.org/security/advisory/typo3-core-sa-2019-013"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/TYPO3/typo3","events":[{"introduced":"3ca26fbd711b62db4cc6df5ff7b98d4a99b14670"},{"last_affected":"77f092b4b9a9690fbd033ee8e2e9112f3ea7e08f"}],"database_specific":{"extracted_events":[{"introduced":"8.7.25"},{"last_affected":"8.7.25"},{"introduced":"9.5.6"},{"last_affected":"9.5.6"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:typo3:typo3:8.7.25:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:9.5.6:*:*:*:*:*:*:*"]}}],"versions":["8.7.25","9.5.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15241.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/typo3/fluid","events":[{"introduced":"0"},{"fixed":"745a99973f5c88e110377dd484745e92e430293c"},{"introduced":"617595f736ca1e880817cea852572b9b0b329f39"},{"fixed":"abdcefa62a618e02dbd429b910f951f4101b5d44"},{"introduced":"48e434663ec3844bd8f8f91f8fa33587b1a643e2"},{"fixed":"75e5675e30b6dae17814aadd746a6b6145b095ef"},{"introduced":"b36c00a756cea9df944be0ef2e4827554646832a"},{"fixed":"1e461d22b496f466c158c8be9a2821e6dc8dfc86"},{"introduced":"f583badd3b2a90f046fe5c1e0459300325a3e0ce"},{"fixed":"27d81c7ec1e70609a5f937ba73dc62dd9708afe1"},{"introduced":"5dc5836bf1bb3465cb0cc69f6471c5519d33b934"},{"fixed":"e4ca051ad105a6bce02b2809172fb26d45fd06a3"},{"introduced":"e3533d0b80e4020cf0de7a546efaae25866f898b"},{"fixed":"9ef6a8ffff2e812025fc0701b4ce72eea6911a3d"}],"database_specific":{"cpe":"cpe:2.3:a:typo3:fluid_engine:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.0.5"},{"introduced":"2.1.0"},{"fixed":"2.1.4"},{"introduced":"2.2.0"},{"fixed":"2.2.1"},{"introduced":"2.3.0"},{"fixed":"2.3.5"},{"introduced":"2.4.0"},{"fixed":"2.4.1"},{"introduced":"2.5.0"},{"fixed":"2.5.5"},{"introduced":"2.6.0"},{"fixed":"2.6.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["2.4.0","2.2.0","2.5.4","2.6.0","2.0.4","2.1.3","2.5.3","2.5.2","2.5.1","2.3.4","2.5.0","2.3.3","2.3.2","2.3.1","2.3.0","2.1.2","2.1.1","2.1.0","2.0.3","2.0.2","2.0.1","2.0.0","1.1.1","1.1.0","1.0.7","1.0.6","1.0.5","1.0.4","1.0.3","1.0.2","1.0.1","1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15241.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/typo3/typo3","events":[{"introduced":"3ca26fbd711b62db4cc6df5ff7b98d4a99b14670"},{"last_affected":"77f092b4b9a9690fbd033ee8e2e9112f3ea7e08f"}],"database_specific":{"cpe":["cpe:2.3:a:typo3:typo3:8.7.25:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:9.5.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.7.25"},{"last_affected":"8.7.25"},{"introduced":"9.5.6"},{"last_affected":"9.5.6"}],"source":"CPE_STRING"}}],"versions":["8.7.25","9.5.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15241.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}