J. Greil

The issue allows attackers to access a cookie value via a client-side script because Limesurvey uses an anti-CSRF cookie without the HttpOnly flag.

A clickjacking issue was discovered.

A stored cross-site scripting issue was discovered that allows authenticated users with the correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page.

The issue is related to the lack of enforcement of SSL/TLS usage in the default configuration.

The issue allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used.

The issue allows admin users to mark other users' notifications as read.

A reflected cross-site scripting (XSS) issue was discovered, allowing remote attackers to inject arbitrary web script or HTML via extensions of uploaded files.

The issue allows admin users to view, update, or delete reserved menu entries without having the proper permissions.

The issue allows admin users to access the plugin manager without having the proper permissions.

Name of the Vulnerable Software and Affected Versions: Typo3 versions 3.7, 3.8, 4.0.0 through 4.0.3, and 4.1 beta with the rtehtmlarea extension Description: The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the `userUid` parameter to "rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php". Recommendations: For Typo3 versions 3.7, 3.8, 4.0.0 through 4.0.3, and 4.1 beta with the rtehtmlarea extension, avoid using the `userUid` parameter in the affected API endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the rtehtmlarea extension to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.