The Typo3 version branches 6.x, 7.x and 4.x are vulnerable to an authenticated,
non-persistent Cross-Site Scripting vulnerability when user-supplied input
is processed by the sanitizeLocalUrl() function. While there is already a
XSS filter in place, it is possible to mitigate it by using a data URI with
a base64 encoded payload.
- Versions 4.0.0 to 4.5.40
- Versions 6.2.0 to 6.2.14
- Versions 7.0.0 to 7.3.0
Update to TYPO3 versions 6.2.15 or 7.4.0 that fix the problem described.