Read the docs
TI-2013-04433 Aliases CVE-2013-5100GHSA-4mm3-xgc2-656r

Cross-site scripting (XSS) vulnerability in the Static Methods since 2007 (div2007)…

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in the Static Methods since 2007 (div2007) extension before 0.10.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the t3lib_div::quoteJSvalue function.

Why it matters now

EPSS 0.01284 70th percentileScored 2026-11-07
Fix Fixed jambagecom/div2007 (Packagist): 0.10.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—jambagecom/div2007 (Packagist)before 0.10.20.10.2Patch availableGHSA-4mm3-xgc2-656r
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • jambagecom/div2007 (Packagist) Vendor— Affected before 0.10.2 Fixed in 0.10.2 Patch available GHSA-4mm3-xgc2-656r

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:franz_holzinger:static_methods:*:*:*:*:*:*:*:*up to 0.5.1VulnerableFranz Holzinger
cpe:2.3:a:franz_holzinger:static_methods:0.4.0:*:*:*:*:*:*:*0.4.0VulnerableFranz Holzinger
cpe:2.3:a:franz_holzinger:static_methods:0.4.1:*:*:*:*:*:*:*0.4.1VulnerableFranz Holzinger
cpe:2.3:a:franz_holzinger:static_methods:0.4.2:*:*:*:*:*:*:*0.4.2VulnerableFranz Holzinger
cpe:2.3:a:franz_holzinger:static_methods:0.4.3:*:*:*:*:*:*:*0.4.3VulnerableFranz Holzinger
cpe:2.3:a:franz_holzinger:static_methods:0.4.4:*:*:*:*:*:*:*0.4.4VulnerableFranz Holzinger
cpe:2.3:a:franz_holzinger:static_methods:0.4.5:*:*:*:*:*:*:*0.4.5VulnerableFranz Holzinger
cpe:2.3:a:franz_holzinger:static_methods:0.4.6:*:*:*:*:*:*:*0.4.6VulnerableFranz Holzinger
cpe:2.3:a:franz_holzinger:static_methods:0.5.0:*:*:*:*:*:*:*0.5.0VulnerableFranz Holzinger
  • cpe:2.3:a:franz_holzinger:static_methods:*:*:*:*:*:*:*:* Versions up to 0.5.1 Vulnerable ·Franz Holzinger
  • cpe:2.3:a:franz_holzinger:static_methods:0.4.0:*:*:*:*:*:*:* Versions 0.4.0 Vulnerable ·Franz Holzinger
  • cpe:2.3:a:franz_holzinger:static_methods:0.4.1:*:*:*:*:*:*:* Versions 0.4.1 Vulnerable ·Franz Holzinger
  • cpe:2.3:a:franz_holzinger:static_methods:0.4.2:*:*:*:*:*:*:* Versions 0.4.2 Vulnerable ·Franz Holzinger
  • cpe:2.3:a:franz_holzinger:static_methods:0.4.3:*:*:*:*:*:*:* Versions 0.4.3 Vulnerable ·Franz Holzinger
  • cpe:2.3:a:franz_holzinger:static_methods:0.4.4:*:*:*:*:*:*:* Versions 0.4.4 Vulnerable ·Franz Holzinger
  • cpe:2.3:a:franz_holzinger:static_methods:0.4.5:*:*:*:*:*:*:* Versions 0.4.5 Vulnerable ·Franz Holzinger
  • cpe:2.3:a:franz_holzinger:static_methods:0.4.6:*:*:*:*:*:*:* Versions 0.4.6 Vulnerable ·Franz Holzinger
  • cpe:2.3:a:franz_holzinger:static_methods:0.5.0:*:*:*:*:*:*:* Versions 0.5.0 Vulnerable ·Franz Holzinger

Remediation

  • Fix · GHSA-4mm3-xgc2-656r jambagecom/div2007 (Packagist) Fixed in 0.10.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-5100
  2. 2026-10-03 Alias added: GHSA-4mm3-xgc2-656r

References

Advisory 3

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences