TYPO3 DCD GoogleMap Extension Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	29815
Class:	Input Validation Error
CVE:	CVE-2008-6687
Remote:	Yes
Local:	No
Published:	Jun 19 2008 12:00AM
Updated:	Apr 24 2009 10:56PM
Credit:	Jochen Rau
Vulnerable:	Typo3 DCD GoogleMap 1.1
Not Vulnerable:	Typo3 DCD GoogleMap 1.1.1

TYPO3 DCD GoogleMap Extension Unspecified Cross-Site Scripting Vulnerability

The DCD GoogleMap extension for TYPO3 is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to DCD GoogleMap 1.1.1 are vulnerable.

TYPO3 DCD GoogleMap Extension Unspecified Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

TYPO3 DCD GoogleMap Extension Unspecified Cross-Site Scripting Vulnerability

Solution:
The vendor released DCD GoogleMap 1.1.1 to address this issue. Please see the references for more information.


Typo3 DCD GoogleMap 1.1

• Typo3 dcdgooglemap_1.1.1.t3x
  http://typo3.org/fileadmin/ter/d/c/dcdgooglemap_1.1.1.t3x

TYPO3 DCD GoogleMap Extension Unspecified Cross-Site Scripting Vulnerability

References:

• Synnefoims Homepage (synnefoims)
  
• TYPO3 Collective Security Bulletin TYPO3-20080619-1: Several vulnerabilities in (TYPO3)