What is the CVSS score of CVE-2020-15241?

CVE-2020-15241 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 1.0%.

Is there a public PoC exploit available for CVE-2020-15241?

Yes, a public proof-of-concept exploit is available for CVE-2020-15241. Prioritise patching immediately. EPSS: 1.0%.

Is there a patch available for CVE-2020-15241?

Yes, a patch is available for CVE-2020-15241. Update the affected software to the latest version immediately.

Typo3 CVE-2020-15241

Q: Which versions of Typo3 are affected by CVE-2020-15241?

TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional.. A patch is available.

MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2020-10-08 security-advisories@github.com

XSS Open Redirect Typo3 Fluid Engine

6.1

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-601 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V3 - Web Frontend Security Redirect URL validation MITRE ATT&CK 1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 6.1 (MEDIUM). Attack characteristics: network attack vector, low complexity, no privileges required, user interaction required. Public proof-of-concept exploit code is available.
Exploit ScenarioDerived	A remote attacker could redirect users to malicious websites via URL manipulation by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 1.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate redirect destinations against an allowlist, avoid using user input in redirect URLs.

Affected Packages

composer typo3/cms fix: 8.7.25, 9.5.6

composer typo3/cms-core fix: 8.7.25, 9.5.6

composer typo3fluid/fluid fix: 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5, 2.6.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in composer

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Open Redirect (CWE-601), which allows attackers to redirect users to malicious websites via URL manipulation. TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1). Affected products include: Typo3 Fluid Engine, Typo3.

Know when Typo3 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

DescriptionNVD

TYPO3 Fluid Engine (package typo3fluid/fluid) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like {showFullName ? fullName : defaultValue}. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) versions as well: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.4) and TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1).

Threat Intelligence Overview

EPSS Score

1.0%

Top 42% exploitable

Exploit

POC

Public exploit code exists

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 1.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +30

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

Affected Products (CPE)NVD

cpe:2.3:a:typo3:fluid_engine:*:*:*:*:*:*:*:*

cpe:2.3:a:typo3:typo3:8.7.25:*:*:*:*:*:*:*

cpe:2.3:a:typo3:typo3:9.5.6:*:*:*:*:*:*:*

More in Typo3

View all

CVE-2020-15086 CRITICAL Act Now POC

9.8 Jul 29

In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered

CVE-2026-77136 CRITICAL Act Now POC

9.5 Aug 25

Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th

CVE-2017-14251 HIGH This Week POC

8.8 Sep 11

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php i

CVE-2026-46725 CRITICAL Act Now POC

9.2 May 19

Remote code execution in the TYPO3 'Content Element Selector' extension allows unauthenticated attackers to execute arbi

CVE-2014-9509 HIGH This Week POC

7.5 Jan 04

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, w

CVE-2026-19418 HIGH This Week POC

7.3 Aug 11

Broken referrer enforcement in TYPO3 CMS backend and Install Tool allows an attacker with JavaScript execution capabilit

CVE-2016-4056 MEDIUM This Month POC

6.1 Jan 23

Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers t

CVE-2023-24814 MEDIUM This Month POC

6.1 Feb 07

TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. Rated medium

CVE-2020-26227 MEDIUM This Month POC

6.1 Nov 23

TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 6.1), this vulnerability is

CVE-2020-26216 MEDIUM This Month POC

6.1 Nov 17

TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting.

CVE-2020-8091 MEDIUM This Month POC

6.1 Jan 27

svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cr

CVE-2020-11066 CRITICAL Act Now

10.0 May 14

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all

CVE-2017-1000117 HIGH POC

8.8

CVE-2016-5385 HIGH POC

8.1

CVE-2018-11784 MEDIUM POC

4.3

CVE-2017-3528 MEDIUM POC

5.4

CVE-2012-0518 MEDIUM

4.7

CVE-2024-21641 MEDIUM POC

6.5

CVE-2015-5354 MEDIUM POC

5.8

CVE-2024-22891 CRITICAL POC

9.8

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

9.8

CVE-2020-3580 MEDIUM POC

6.1

CVE-2013-1710 CRITICAL POC

10.0

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2024-52875 HIGH POC

8.8

References

Advisories & patches

PATCH https://github.com/TYPO3/Fluid/commit/9ef6a8ffff2e812025fc0701b4ce72eea6911a3d

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back