CVE-2019-25094: XSS in TYPO3 Appointments Extension

Successful exploitation of CVE-2019-25094 allows an attacker to inject arbitrary JavaScript code into the TYPO3 Appointments Extension. This code can then be executed in the context of a user's browser, potentially leading to session hijacking, credential theft, or defacement of the website. The attacker could also redirect users to malicious websites or install malware. Given the widespread use of TYPO3 and its extensions, this vulnerability could have a significant impact if exploited on a large scale. The ability to manipulate formfield arguments remotely makes this vulnerability particularly concerning.

1. Reserved2023-01-04
2. Published2023-01-04
3. Modified2024-08-05
4. EPSS updated2026-04-02

The primary mitigation for CVE-2019-25094 is to upgrade the appointments Extension to version 2.0.6 or later. This version includes a patch (identifier: 986d3cb34e5e086c6f04e061f600ffc5837abe7f) that addresses the vulnerability. If immediate upgrading is not possible, consider implementing input validation and sanitization on the Appointment Handler to prevent the injection of malicious scripts. While a Web Application Firewall (WAF) might offer some protection, it's not a substitute for patching. After upgrading, verify the fix by attempting to submit a form with a crafted payload containing a JavaScript snippet; the payload should be properly sanitized and not executed.