cveboard RSS feed

CVE-2020-26229

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2020
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

XML External Entity in Dashboard Widget

TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. Update to TYPO3 version 10.4.10 to fix the problem described.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

TYPO3.CMS

Vendor
TYPO3
Product
TYPO3.CMS
Platforms
Unknown
Default status
Unknown
TYPO3.CMS · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
>= 10.0.0, < 10.4.10affectedUnavailableUnavailableUnavailableNone listed