Read the docs
TI-2017-03878 Aliases CVE-2017-5963GHSA-8c25-g8jq-vfpw

An issue was discovered in caddy (for TYPO3) before 7.2.10.

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

An issue was discovered in caddy (for TYPO3) before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken" HTTP POST parameter passed to the "caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Why it matters now

EPSS 0.01027 63rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:caddy_project:caddy:2.1.4:alpha:*:*:*:typo3:*:*2.1.4 alphaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:2.1.5:alpha:*:*:*:typo3:*:*2.1.5 alphaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:2.1.6:alpha:*:*:*:typo3:*:*2.1.6 alphaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:3.0.0:alpha:*:*:*:typo3:*:*3.0.0 alphaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:4.0.0:alpha:*:*:*:typo3:*:*4.0.0 alphaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:4.0.1:alpha:*:*:*:typo3:*:*4.0.1 alphaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:4.0.2:alpha:*:*:*:typo3:*:*4.0.2 alphaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:4.0.3:alpha:*:*:*:typo3:*:*4.0.3 alphaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:4.0.12:alpha:*:*:*:typo3:*:*4.0.12 alphaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:6.0.1:alpha:*:*:*:typo3:*:*6.0.1 alphaVulnerableCaddy Project
  • cpe:2.3:a:caddy_project:caddy:2.1.4:alpha:*:*:*:typo3:*:* Versions 2.1.4 alpha Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:2.1.5:alpha:*:*:*:typo3:*:* Versions 2.1.5 alpha Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:2.1.6:alpha:*:*:*:typo3:*:* Versions 2.1.6 alpha Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:3.0.0:alpha:*:*:*:typo3:*:* Versions 3.0.0 alpha Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:4.0.0:alpha:*:*:*:typo3:*:* Versions 4.0.0 alpha Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:4.0.1:alpha:*:*:*:typo3:*:* Versions 4.0.1 alpha Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:4.0.2:alpha:*:*:*:typo3:*:* Versions 4.0.2 alpha Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:4.0.3:alpha:*:*:*:typo3:*:* Versions 4.0.3 alpha Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:4.0.12:alpha:*:*:*:typo3:*:* Versions 4.0.12 alpha Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:6.0.1:alpha:*:*:*:typo3:*:* Versions 6.0.1 alpha Vulnerable ·Caddy Project
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:caddy_project:caddy:6.0.2:alpha:*:*:*:typo3:*:*6.0.2 alphaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:6.0.9:alpha:*:*:*:typo3:*:*6.0.9 alphaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:6.0.12:beta:*:*:*:typo3:*:*6.0.12 betaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:6.0.14:beta:*:*:*:typo3:*:*6.0.14 betaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:6.1.0:beta:*:*:*:typo3:*:*6.1.0 betaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:6.2.1:beta:*:*:*:typo3:*:*6.2.1 betaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:6.3.0:beta:*:*:*:typo3:*:*6.3.0 betaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:6.3.1:beta:*:*:*:typo3:*:*6.3.1 betaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:6.3.3:beta:*:*:*:typo3:*:*6.3.3 betaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:7.0.0:beta:*:*:*:typo3:*:*7.0.0 betaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:7.1.0:beta:*:*:*:typo3:*:*7.1.0 betaVulnerableCaddy Project
cpe:2.3:a:caddy_project:caddy:7.2.7:beta:*:*:*:typo3:*:*7.2.7 betaVulnerableCaddy Project
  • cpe:2.3:a:caddy_project:caddy:6.0.2:alpha:*:*:*:typo3:*:* Versions 6.0.2 alpha Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:6.0.9:alpha:*:*:*:typo3:*:* Versions 6.0.9 alpha Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:6.0.12:beta:*:*:*:typo3:*:* Versions 6.0.12 beta Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:6.0.14:beta:*:*:*:typo3:*:* Versions 6.0.14 beta Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:6.1.0:beta:*:*:*:typo3:*:* Versions 6.1.0 beta Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:6.2.1:beta:*:*:*:typo3:*:* Versions 6.2.1 beta Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:6.3.0:beta:*:*:*:typo3:*:* Versions 6.3.0 beta Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:6.3.1:beta:*:*:*:typo3:*:* Versions 6.3.1 beta Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:6.3.3:beta:*:*:*:typo3:*:* Versions 6.3.3 beta Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:7.0.0:beta:*:*:*:typo3:*:* Versions 7.0.0 beta Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:7.1.0:beta:*:*:*:typo3:*:* Versions 7.1.0 beta Vulnerable ·Caddy Project
  • cpe:2.3:a:caddy_project:caddy:7.2.7:beta:*:*:*:typo3:*:* Versions 7.2.7 beta Vulnerable ·Caddy Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-5963
  2. 2026-10-03 Alias added: GHSA-8c25-g8jq-vfpw

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences