CVE-2013-7074
Summary
| CVE | CVE-2013-7074 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2013-12-21 00:55:04 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters. |
Risk And Classification
Primary CVSS: v2.0 3.5 from [email protected]
AV:N/AC:M/Au:S/C:N/I:P/A:N
EPSS: 0.010940000 probability, percentile 0.618710000 (date 2026-07-21)
Problem Types: CWE-79 | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
SingleConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:S/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Typo3 | Typo3 | 4.5.0 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.1 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.10 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.11 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.12 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.13 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.14 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.15 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.16 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.17 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.18 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.19 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.2 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.20 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.21 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.22 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.23 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.24 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.25 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.26 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.27 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.28 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.29 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.3 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.30 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.31 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.4 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.5 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.6 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.7 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.8 | All | All | All |
| Application | Typo3 | Typo3 | 4.5.9 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.0 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.1 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.10 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.11 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.12 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.13 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.14 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.15 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.16 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.2 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.3 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.4 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.5 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.6 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.7 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.8 | All | All | All |
| Application | Typo3 | Typo3 | 4.7.9 | All | All | All |
| Application | Typo3 | Typo3 | 6.0 | All | All | All |
| Application | Typo3 | Typo3 | 6.0.1 | All | All | All |
| Application | Typo3 | Typo3 | 6.0.10 | All | All | All |
| Application | Typo3 | Typo3 | 6.0.11 | All | All | All |
| Application | Typo3 | Typo3 | 6.0.2 | All | All | All |
| Application | Typo3 | Typo3 | 6.0.3 | All | All | All |
| Application | Typo3 | Typo3 | 6.0.4 | All | All | All |
| Application | Typo3 | Typo3 | 6.0.5 | All | All | All |
| Application | Typo3 | Typo3 | 6.0.6 | All | All | All |
| Application | Typo3 | Typo3 | 6.0.7 | All | All | All |
| Application | Typo3 | Typo3 | 6.0.8 | All | All | All |
| Application | Typo3 | Typo3 | 6.0.9 | All | All | All |
| Application | Typo3 | Typo3 | 6.1 | All | All | All |
| Application | Typo3 | Typo3 | 6.1.1 | All | All | All |
| Application | Typo3 | Typo3 | 6.1.2 | All | All | All |
| Application | Typo3 | Typo3 | 6.1.3 | All | All | All |
| Application | Typo3 | Typo3 | 6.1.4 | All | All | All |
| Application | Typo3 | Typo3 | 6.1.5 | All | All | All |
| Application | Typo3 | Typo3 | 6.1.6 | All | All | All |
| Application | Typo3 | Typo3 | 6.2.0 | beta1 | All | All |
| Application | Typo3 | Typo3 | 6.2.0 | beta2 | All | All |
| Application | Typo3 | Typo3 | 6.2.0 | beta3 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| TYPO3 Content Editing Wizards Unspecified Cross Site Scripting Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| oss-sec: CVE request: TYPO3-CORE-SA-2013-004 and TYPO3-FLOW-SA-2013-001 | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | |
| oss-sec: Re: CVE request: TYPO3-CORE-SA-2013-004 and TYPO3-FLOW-SA-2013-001 | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | |
| osvdb.org/100881 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| Debian -- Security Information -- DSA-2834-1 typo3-src | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Multiple Vulnerabilities in TYPO3 CMS - TYPO3 - The Enterprise Open Source CMS | af854a3a-2127-422b-91ae-364da2661108 | typo3.org | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.