| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-4hp8-5qeb-wyam |
| vulnerability_id |
VCID-4hp8-5qeb-wyam |
| summary |
TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, the backend user management interface allows password changes without requiring the current password. When an administrator updates their own account or modifies other user accounts via the admin interface, the current password is not requested for verification. This behavior may lower the protection against unauthorized access in scenarios where an admin session is hijacked or left unattended, as it enables password changes without additional authentication. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-47938, GHSA-3jrg-97f3-rqh9
|
| risk_score |
1.7 |
| exploitability |
0.5 |
| weighted_severity |
3.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4hp8-5qeb-wyam |
|
| 1 |
| url |
VCID-4ntq-jdtt-7fad |
| vulnerability_id |
VCID-4ntq-jdtt-7fad |
| summary |
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.29 |
| purl |
pkg:composer/typo3/cms-core@10.4.29 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-66qa-16we-wkdw |
|
| 3 |
| vulnerability |
VCID-6g94-zrcc-mqf2 |
|
| 4 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 5 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 6 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 7 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 8 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 9 |
| vulnerability |
VCID-c34f-fptt-tfgt |
|
| 10 |
| vulnerability |
VCID-cmzk-5bm5-hbep |
|
| 11 |
| vulnerability |
VCID-d7rj-6q7r-dug5 |
|
| 12 |
| vulnerability |
VCID-fajx-7vk2-yfd4 |
|
| 13 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 14 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 15 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 16 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 17 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 18 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 19 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 20 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 21 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 22 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 23 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 24 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 25 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 26 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 27 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.29 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.11 |
| purl |
pkg:composer/typo3/cms-core@11.5.11 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-66qa-16we-wkdw |
|
| 3 |
| vulnerability |
VCID-6g94-zrcc-mqf2 |
|
| 4 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 5 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 6 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 7 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 8 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 9 |
| vulnerability |
VCID-c34f-fptt-tfgt |
|
| 10 |
| vulnerability |
VCID-cmzk-5bm5-hbep |
|
| 11 |
| vulnerability |
VCID-d7rj-6q7r-dug5 |
|
| 12 |
| vulnerability |
VCID-fajx-7vk2-yfd4 |
|
| 13 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 14 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 15 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 16 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 17 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 18 |
| vulnerability |
VCID-ra2c-x1g8-tyhy |
|
| 19 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 20 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 21 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 22 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 23 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 24 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 25 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 26 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 27 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 28 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.11 |
|
|
| aliases |
CVE-2022-31049, GHSA-h4mx-xv96-2jgm
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4ntq-jdtt-7fad |
|
| 2 |
| url |
VCID-5ddb-qvu6-c7dd |
| vulnerability_id |
VCID-5ddb-qvu6-c7dd |
| summary |
TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.33 |
| purl |
pkg:composer/typo3/cms-core@10.4.33 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 8 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 9 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 10 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 11 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 12 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 13 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 14 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 15 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 16 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.33 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.20 |
| purl |
pkg:composer/typo3/cms-core@11.5.20 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 8 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 9 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 10 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 11 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 12 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 13 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 14 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 15 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 16 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.20 |
|
| 2 |
| url |
pkg:composer/typo3/cms-core@12.1.1 |
| purl |
pkg:composer/typo3/cms-core@12.1.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-ant9-spg8-1ug5 |
|
| 5 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 6 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 7 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 8 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 9 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 10 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 11 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 12 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 13 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 14 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 15 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 16 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 17 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@12.1.1 |
|
|
| aliases |
CVE-2022-23504, GHSA-8w3p-qh3x-6gjr, GMS-2022-8131
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5ddb-qvu6-c7dd |
|
| 3 |
| url |
VCID-66qa-16we-wkdw |
| vulnerability_id |
VCID-66qa-16we-wkdw |
| summary |
TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.32 |
| purl |
pkg:composer/typo3/cms-core@10.4.32 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.32 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.16 |
| purl |
pkg:composer/typo3/cms-core@11.5.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.16 |
|
|
| aliases |
CVE-2022-36108, GHSA-fv2m-9249-qx85
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-66qa-16we-wkdw |
|
| 4 |
| url |
VCID-6g94-zrcc-mqf2 |
| vulnerability_id |
VCID-6g94-zrcc-mqf2 |
| summary |
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.32 |
| purl |
pkg:composer/typo3/cms-core@10.4.32 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.32 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.16 |
| purl |
pkg:composer/typo3/cms-core@11.5.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.16 |
|
|
| aliases |
CVE-2022-36106, GHSA-5959-4x58-r8c2
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6g94-zrcc-mqf2 |
|
| 5 |
| url |
VCID-9ce2-hvqa-97c5 |
| vulnerability_id |
VCID-9ce2-hvqa-97c5 |
| summary |
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.29 |
| purl |
pkg:composer/typo3/cms-core@10.4.29 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-66qa-16we-wkdw |
|
| 3 |
| vulnerability |
VCID-6g94-zrcc-mqf2 |
|
| 4 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 5 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 6 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 7 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 8 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 9 |
| vulnerability |
VCID-c34f-fptt-tfgt |
|
| 10 |
| vulnerability |
VCID-cmzk-5bm5-hbep |
|
| 11 |
| vulnerability |
VCID-d7rj-6q7r-dug5 |
|
| 12 |
| vulnerability |
VCID-fajx-7vk2-yfd4 |
|
| 13 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 14 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 15 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 16 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 17 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 18 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 19 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 20 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 21 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 22 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 23 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 24 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 25 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 26 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 27 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.29 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.11 |
| purl |
pkg:composer/typo3/cms-core@11.5.11 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-66qa-16we-wkdw |
|
| 3 |
| vulnerability |
VCID-6g94-zrcc-mqf2 |
|
| 4 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 5 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 6 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 7 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 8 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 9 |
| vulnerability |
VCID-c34f-fptt-tfgt |
|
| 10 |
| vulnerability |
VCID-cmzk-5bm5-hbep |
|
| 11 |
| vulnerability |
VCID-d7rj-6q7r-dug5 |
|
| 12 |
| vulnerability |
VCID-fajx-7vk2-yfd4 |
|
| 13 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 14 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 15 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 16 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 17 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 18 |
| vulnerability |
VCID-ra2c-x1g8-tyhy |
|
| 19 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 20 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 21 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 22 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 23 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 24 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 25 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 26 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 27 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 28 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.11 |
|
|
| aliases |
CVE-2022-31046, GHSA-8gmv-9hwg-w89g
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9ce2-hvqa-97c5 |
|
| 6 |
| url |
VCID-9f74-pxxq-3qea |
| vulnerability_id |
VCID-9f74-pxxq-3qea |
| summary |
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-34357, GHSA-hw6c-6gwq-3m3m
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9f74-pxxq-3qea |
|
| 7 |
| url |
VCID-9fu7-2brx-j3az |
| vulnerability_id |
VCID-9fu7-2brx-j3az |
| summary |
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&...&frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-34358, GHSA-36g8-62qv-5957
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9fu7-2brx-j3az |
|
| 8 |
| url |
VCID-9kzb-yw93-rqd3 |
| vulnerability_id |
VCID-9kzb-yw93-rqd3 |
| summary |
TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.33 |
| purl |
pkg:composer/typo3/cms-core@10.4.33 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 8 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 9 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 10 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 11 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 12 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 13 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 14 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 15 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 16 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.33 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.20 |
| purl |
pkg:composer/typo3/cms-core@11.5.20 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 8 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 9 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 10 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 11 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 12 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 13 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 14 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 15 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 16 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.20 |
|
|
| aliases |
CVE-2022-23500, GHSA-8c28-5mp7-v24h, GMS-2022-8130
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9kzb-yw93-rqd3 |
|
| 9 |
| url |
VCID-9mh5-8n3y-93c8 |
| vulnerability_id |
VCID-9mh5-8n3y-93c8 |
| summary |
TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via `FrontendGroupRestriction` to the first table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-47937, GHSA-x8pv-fgxp-8v3x
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9mh5-8n3y-93c8 |
|
| 10 |
| url |
VCID-arjb-mbgt-97dh |
| vulnerability_id |
VCID-arjb-mbgt-97dh |
| summary |
TYPO3 is an open source, PHP based web content management system. Starting in version 10.0.0 and prior to versions 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, administrator-level backend users without system maintainer privileges can escalate their privileges and gain system maintainer access. Exploiting this vulnerability requires a valid administrator account. Users should update to TYPO3 version 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-47940, GHSA-6frx-j292-c844
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-arjb-mbgt-97dh |
|
| 11 |
| url |
VCID-c34f-fptt-tfgt |
| vulnerability_id |
VCID-c34f-fptt-tfgt |
| summary |
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.32 |
| purl |
pkg:composer/typo3/cms-core@10.4.32 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.32 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.16 |
| purl |
pkg:composer/typo3/cms-core@11.5.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.16 |
|
|
| aliases |
GHSA-gqqf-g5r7-84vf, GMS-2022-4096
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-c34f-fptt-tfgt |
|
| 12 |
| url |
VCID-cmzk-5bm5-hbep |
| vulnerability_id |
VCID-cmzk-5bm5-hbep |
| summary |
The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows for a bypass of the cross-site scripting mechanism of `typo3/html-sanitizer`. This issue has been addressed in versions 1.0.7 and 2.0.16 of the `typo3/html-sanitizer` package. Users are advised to upgrade. There are no known workarounds for this issue. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.32 |
| purl |
pkg:composer/typo3/cms-core@10.4.32 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.32 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.16 |
| purl |
pkg:composer/typo3/cms-core@11.5.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.16 |
|
|
| aliases |
CVE-2022-36020, GHSA-47m6-46mj-p235
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cmzk-5bm5-hbep |
|
| 13 |
| url |
VCID-d7rj-6q7r-dug5 |
| vulnerability_id |
VCID-d7rj-6q7r-dug5 |
| summary |
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.32 |
| purl |
pkg:composer/typo3/cms-core@10.4.32 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.32 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.16 |
| purl |
pkg:composer/typo3/cms-core@11.5.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.16 |
|
|
| aliases |
CVE-2022-36107, GHSA-9c6w-55cp-5w25
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-d7rj-6q7r-dug5 |
|
| 14 |
| url |
VCID-fajx-7vk2-yfd4 |
| vulnerability_id |
VCID-fajx-7vk2-yfd4 |
| summary |
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new `MimicServiceInterface::mimicAuthUser`, which simulates corresponding times regular processing would usually take. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix this problem. There are no known workarounds for this issue. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.32 |
| purl |
pkg:composer/typo3/cms-core@10.4.32 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.32 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.16 |
| purl |
pkg:composer/typo3/cms-core@11.5.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 3 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 4 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 5 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 6 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 7 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 8 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 9 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 10 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 11 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 12 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 13 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 14 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 15 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 16 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 17 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 18 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 19 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 20 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 21 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.16 |
|
|
| aliases |
CVE-2022-36105, GHSA-m392-235j-9r7r
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fajx-7vk2-yfd4 |
|
| 15 |
| url |
VCID-g6wm-gjsy-7fdt |
| vulnerability_id |
VCID-g6wm-gjsy-7fdt |
| summary |
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-25120, GHSA-wf85-8hx9-gj7c
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-g6wm-gjsy-7fdt |
|
| 16 |
| url |
VCID-humm-nga7-hbe4 |
| vulnerability_id |
VCID-humm-nga7-hbe4 |
| summary |
TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.33 |
| purl |
pkg:composer/typo3/cms-core@10.4.33 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 8 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 9 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 10 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 11 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 12 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 13 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 14 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 15 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 16 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.33 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.20 |
| purl |
pkg:composer/typo3/cms-core@11.5.20 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 8 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 9 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 10 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 11 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 12 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 13 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 14 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 15 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 16 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.20 |
|
| 2 |
| url |
pkg:composer/typo3/cms-core@12.1.1 |
| purl |
pkg:composer/typo3/cms-core@12.1.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-ant9-spg8-1ug5 |
|
| 5 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 6 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 7 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 8 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 9 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 10 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 11 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 12 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 13 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 14 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 15 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 16 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 17 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@12.1.1 |
|
|
| aliases |
CVE-2022-23501, GHSA-jfp7-79g7-89rf, GMS-2022-8134
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-humm-nga7-hbe4 |
|
| 17 |
| url |
VCID-jtqp-g65r-93hs |
| vulnerability_id |
VCID-jtqp-g65r-93hs |
| summary |
TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 fix the problem. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.30 |
| purl |
pkg:composer/typo3/cms-core@11.5.30 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 7 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 8 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 9 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 10 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 11 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 12 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 13 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 14 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.30 |
|
| 2 |
| url |
pkg:composer/typo3/cms-core@12.4.4 |
| purl |
pkg:composer/typo3/cms-core@12.4.4 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-ant9-spg8-1ug5 |
|
| 5 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 6 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 7 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 8 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 9 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 10 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 11 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 12 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 13 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 14 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 15 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@12.4.4 |
|
|
| aliases |
CVE-2023-38499, GHSA-jq6g-4v5m-wm9r
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jtqp-g65r-93hs |
|
| 18 |
| url |
VCID-p2gb-esw8-3ya7 |
| vulnerability_id |
VCID-p2gb-esw8-3ya7 |
| summary |
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows attackers to inject malicious content. In combination with the TypoScript setting `config.absRefPrefix=auto`, attackers can inject malicious HTML code to pages that have not been rendered and cached, yet. As a result, injected values would be cached and delivered to other website visitors (persisted cross-site scripting). Individual code which relies on the resolved value of `GeneralUtility::getIndpEnv('SCRIPT_NAME')` and corresponding usages (as shown below) are vulnerable as well. Additional investigations confirmed that at least Apache web server deployments using CGI (FPM, FCGI/FastCGI, and similar) are affected. However, there still might be the risk that other scenarios like nginx, IIS, or Apache/mod_php are vulnerable. The usage of server environment variable `PATH_INFO` has been removed from corresponding processings in `GeneralUtility::getIndpEnv()`. Besides that, the public property `TypoScriptFrontendController::$absRefPrefix` is encoded for both being used as a URI component and for being used as a prefix in an HTML context. This mitigates the cross-site scripting vulnerability. Users are advised to update to TYPO3 versions 8.7.51 ELTS, 9.5.40 ELTS, 10.4.35 LTS, 11.5.23 LTS and 12.2.0 which fix this problem. For users who are unable to patch in a timely manner the TypoScript setting `config.absRefPrefix` should at least be set to a static path value, instead of using auto - e.g. `config.absRefPrefix=/`. This workaround **does not fix all aspects of the vulnerability**, and is just considered to be an intermediate mitigation to the most prominent manifestation. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.36 |
| purl |
pkg:composer/typo3/cms-core@10.4.36 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 8 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 9 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 10 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 11 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 12 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 13 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 14 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 15 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.36 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.23 |
| purl |
pkg:composer/typo3/cms-core@11.5.23 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 8 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 9 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 10 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 11 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 12 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 13 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 14 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 15 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.23 |
|
| 2 |
| url |
pkg:composer/typo3/cms-core@12.2.0 |
| purl |
pkg:composer/typo3/cms-core@12.2.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-ant9-spg8-1ug5 |
|
| 5 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 6 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 7 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 8 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 9 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 10 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 11 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 12 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 13 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 14 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 15 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 16 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@12.2.0 |
|
|
| aliases |
CVE-2023-24814, GHSA-r4f8-f93x-5qh3
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-p2gb-esw8-3ya7 |
|
| 19 |
| url |
VCID-qnk5-9jfz-5bhh |
| vulnerability_id |
VCID-qnk5-9jfz-5bhh |
| summary |
TYPO3 is a free and open source Content Management Framework. Applications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via a query parameter) and validate the host of the parsed URL may be vulnerable to open redirect or SSRF attacks if the URL is used after passing the validation checks. Users are advised to update to TYPO3 versions 9.5.49 ELTS, 10.4.48 ELTS, 11.5.42 LTS, 12.4.25 LTS, 13.4.3 which fix the problem described. There are no known workarounds for this vulnerability. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-55892, GHSA-2fx5-pggv-6jjr
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qnk5-9jfz-5bhh |
|
| 20 |
| url |
VCID-rmxx-e239-5uf8 |
| vulnerability_id |
VCID-rmxx-e239-5uf8 |
| summary |
TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.29 |
| purl |
pkg:composer/typo3/cms-core@10.4.29 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-66qa-16we-wkdw |
|
| 3 |
| vulnerability |
VCID-6g94-zrcc-mqf2 |
|
| 4 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 5 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 6 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 7 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 8 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 9 |
| vulnerability |
VCID-c34f-fptt-tfgt |
|
| 10 |
| vulnerability |
VCID-cmzk-5bm5-hbep |
|
| 11 |
| vulnerability |
VCID-d7rj-6q7r-dug5 |
|
| 12 |
| vulnerability |
VCID-fajx-7vk2-yfd4 |
|
| 13 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 14 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 15 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 16 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 17 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 18 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 19 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 20 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 21 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 22 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 23 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 24 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 25 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 26 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 27 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.29 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.11 |
| purl |
pkg:composer/typo3/cms-core@11.5.11 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-66qa-16we-wkdw |
|
| 3 |
| vulnerability |
VCID-6g94-zrcc-mqf2 |
|
| 4 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 5 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 6 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 7 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 8 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 9 |
| vulnerability |
VCID-c34f-fptt-tfgt |
|
| 10 |
| vulnerability |
VCID-cmzk-5bm5-hbep |
|
| 11 |
| vulnerability |
VCID-d7rj-6q7r-dug5 |
|
| 12 |
| vulnerability |
VCID-fajx-7vk2-yfd4 |
|
| 13 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 14 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 15 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 16 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 17 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 18 |
| vulnerability |
VCID-ra2c-x1g8-tyhy |
|
| 19 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 20 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 21 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 22 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 23 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 24 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 25 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 26 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 27 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 28 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.11 |
|
|
| aliases |
CVE-2022-31048, GHSA-3r95-23jp-mhvg
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rmxx-e239-5uf8 |
|
| 21 |
| url |
VCID-rxu6-ccns-m3fk |
| vulnerability_id |
VCID-rxu6-ccns-m3fk |
| summary |
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1 fix the problem described. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-34356, GHSA-v6mw-h7w6-59w3
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rxu6-ccns-m3fk |
|
| 22 |
| url |
VCID-sq7n-ehxa-rbb9 |
| vulnerability_id |
VCID-sq7n-ehxa-rbb9 |
| summary |
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed attackers to crack the plaintext password using brute force techniques. Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-25118, GHSA-38r2-5695-334w
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sq7n-ehxa-rbb9 |
|
| 23 |
| url |
VCID-tyba-yxs8-7kgb |
| vulnerability_id |
VCID-tyba-yxs8-7kgb |
| summary |
TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular form item and a valid backend user account with access to the form module are needed to exploit this vulnerability. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.33 |
| purl |
pkg:composer/typo3/cms-core@10.4.33 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 8 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 9 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 10 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 11 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 12 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 13 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 14 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 15 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 16 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.33 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.20 |
| purl |
pkg:composer/typo3/cms-core@11.5.20 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 8 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 9 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 10 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 11 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 12 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 13 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 14 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 15 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 16 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.20 |
|
| 2 |
| url |
pkg:composer/typo3/cms-core@12.1.1 |
| purl |
pkg:composer/typo3/cms-core@12.1.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-ant9-spg8-1ug5 |
|
| 5 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 6 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 7 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 8 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 9 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 10 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 11 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 12 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 13 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 14 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 15 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 16 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 17 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@12.1.1 |
|
|
| aliases |
CVE-2022-23503, GHSA-c5wx-6c2c-f7rm, GMS-2022-8132
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tyba-yxs8-7kgb |
|
| 24 |
| url |
VCID-u1bz-wj83-nbbt |
| vulnerability_id |
VCID-u1bz-wj83-nbbt |
| summary |
TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restriction means it is possible to upload files that may be considered potentially harmful, such as executable binaries (e.g., `.exe` files), or files with inconsistent file extensions and MIME types (for example, a file incorrectly named with a `.png` extension but actually carrying the MIME type `application/zip`) starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS. Although such files are not directly executable through the web server, their presence can introduce indirect risks. For example, third-party services such as antivirus scanners or malware detection systems might flag or block access to the website for end users if suspicious files are found. This could negatively affect the availability or reputation of the site. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-47939, GHSA-9hq9-cr36-4wpj
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u1bz-wj83-nbbt |
|
| 25 |
| url |
VCID-uspd-tbez-gbht |
| vulnerability_id |
VCID-uspd-tbez-gbht |
| summary |
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.29 |
| purl |
pkg:composer/typo3/cms-core@10.4.29 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-66qa-16we-wkdw |
|
| 3 |
| vulnerability |
VCID-6g94-zrcc-mqf2 |
|
| 4 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 5 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 6 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 7 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 8 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 9 |
| vulnerability |
VCID-c34f-fptt-tfgt |
|
| 10 |
| vulnerability |
VCID-cmzk-5bm5-hbep |
|
| 11 |
| vulnerability |
VCID-d7rj-6q7r-dug5 |
|
| 12 |
| vulnerability |
VCID-fajx-7vk2-yfd4 |
|
| 13 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 14 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 15 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 16 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 17 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 18 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 19 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 20 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 21 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 22 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 23 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 24 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 25 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 26 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 27 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.29 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.11 |
| purl |
pkg:composer/typo3/cms-core@11.5.11 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-66qa-16we-wkdw |
|
| 3 |
| vulnerability |
VCID-6g94-zrcc-mqf2 |
|
| 4 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 5 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 6 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 7 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 8 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 9 |
| vulnerability |
VCID-c34f-fptt-tfgt |
|
| 10 |
| vulnerability |
VCID-cmzk-5bm5-hbep |
|
| 11 |
| vulnerability |
VCID-d7rj-6q7r-dug5 |
|
| 12 |
| vulnerability |
VCID-fajx-7vk2-yfd4 |
|
| 13 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 14 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 15 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 16 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 17 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 18 |
| vulnerability |
VCID-ra2c-x1g8-tyhy |
|
| 19 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 20 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 21 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 22 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 23 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 24 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 25 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 26 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 27 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 28 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.11 |
|
|
| aliases |
CVE-2022-31050, GHSA-wwjw-r3gj-39fq
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-uspd-tbez-gbht |
|
| 26 |
| url |
VCID-v1kq-a6wk-bka9 |
| vulnerability_id |
VCID-v1kq-a6wk-bka9 |
| summary |
TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. This issue is patched in versions 10.4.33, 11.5.20, 12.1.1. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.33 |
| purl |
pkg:composer/typo3/cms-core@10.4.33 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 8 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 9 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 10 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 11 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 12 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 13 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 14 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 15 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 16 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.33 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.20 |
| purl |
pkg:composer/typo3/cms-core@11.5.20 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 5 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 6 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 7 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 8 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 9 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 10 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 11 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 12 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 13 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 14 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 15 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 16 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.20 |
|
| 2 |
| url |
pkg:composer/typo3/cms-core@12.1.1 |
| purl |
pkg:composer/typo3/cms-core@12.1.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-ant9-spg8-1ug5 |
|
| 5 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 6 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 7 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 8 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 9 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 10 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 11 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 12 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 13 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 14 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 15 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 16 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 17 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@12.1.1 |
|
|
| aliases |
CVE-2022-23502, GHSA-mgj2-q8wp-29rr, GMS-2022-8135
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-v1kq-a6wk-bka9 |
|
| 27 |
| url |
VCID-vc1g-tqkt-w7gt |
| vulnerability_id |
VCID-vc1g-tqkt-w7gt |
| summary |
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which fix the problem described. When persisting entities of the File Abstraction Layer directly via DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata` entities are not permitted to reference files in the fallback storage anymore. When importing data from secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using `$dataHandler->isImporting = true;`. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-25121, GHSA-rj3x-wvc6-5j66
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vc1g-tqkt-w7gt |
|
| 28 |
| url |
VCID-vcbt-ta48-vybq |
| vulnerability_id |
VCID-vcbt-ta48-vybq |
| summary |
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception handlers, when logging the complete exception stack trace. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 contain a fix for the problem. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:composer/typo3/cms-core@10.4.29 |
| purl |
pkg:composer/typo3/cms-core@10.4.29 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-66qa-16we-wkdw |
|
| 3 |
| vulnerability |
VCID-6g94-zrcc-mqf2 |
|
| 4 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 5 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 6 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 7 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 8 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 9 |
| vulnerability |
VCID-c34f-fptt-tfgt |
|
| 10 |
| vulnerability |
VCID-cmzk-5bm5-hbep |
|
| 11 |
| vulnerability |
VCID-d7rj-6q7r-dug5 |
|
| 12 |
| vulnerability |
VCID-fajx-7vk2-yfd4 |
|
| 13 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 14 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 15 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 16 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 17 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 18 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 19 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 20 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 21 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 22 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 23 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 24 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 25 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 26 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 27 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@10.4.29 |
|
| 1 |
| url |
pkg:composer/typo3/cms-core@11.5.11 |
| purl |
pkg:composer/typo3/cms-core@11.5.11 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-5ddb-qvu6-c7dd |
|
| 2 |
| vulnerability |
VCID-66qa-16we-wkdw |
|
| 3 |
| vulnerability |
VCID-6g94-zrcc-mqf2 |
|
| 4 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 5 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 6 |
| vulnerability |
VCID-9kzb-yw93-rqd3 |
|
| 7 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 8 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 9 |
| vulnerability |
VCID-c34f-fptt-tfgt |
|
| 10 |
| vulnerability |
VCID-cmzk-5bm5-hbep |
|
| 11 |
| vulnerability |
VCID-d7rj-6q7r-dug5 |
|
| 12 |
| vulnerability |
VCID-fajx-7vk2-yfd4 |
|
| 13 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 14 |
| vulnerability |
VCID-humm-nga7-hbe4 |
|
| 15 |
| vulnerability |
VCID-jtqp-g65r-93hs |
|
| 16 |
| vulnerability |
VCID-p2gb-esw8-3ya7 |
|
| 17 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 18 |
| vulnerability |
VCID-ra2c-x1g8-tyhy |
|
| 19 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 20 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 21 |
| vulnerability |
VCID-tyba-yxs8-7kgb |
|
| 22 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 23 |
| vulnerability |
VCID-v1kq-a6wk-bka9 |
|
| 24 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 25 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 26 |
| vulnerability |
VCID-wutq-k9ph-zyab |
|
| 27 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 28 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@11.5.11 |
|
|
| aliases |
CVE-2022-31047, GHSA-fh99-4pgr-8j99
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vcbt-ta48-vybq |
|
| 29 |
| url |
VCID-ve54-aaqx-xkck |
| vulnerability_id |
VCID-ve54-aaqx-xkck |
| summary |
TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/TYPO3/typo3 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.2 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
8.6 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/TYPO3/typo3 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
|
| fixed_packages |
|
| aliases |
CVE-2024-22188, GHSA-5w2h-59j3-8x5w
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ve54-aaqx-xkck |
|
| 30 |
| url |
VCID-wutq-k9ph-zyab |
| vulnerability_id |
VCID-wutq-k9ph-zyab |
| summary |
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the second site without requiring additional authentication. This vulnerability has been addressed in versions 8.7.55, 9.5.44, 10.4.41, 11.5.33, and 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
|
| 2 |
| url |
pkg:composer/typo3/cms-core@12.4.8 |
| purl |
pkg:composer/typo3/cms-core@12.4.8 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-4hp8-5qeb-wyam |
|
| 1 |
| vulnerability |
VCID-9f74-pxxq-3qea |
|
| 2 |
| vulnerability |
VCID-9fu7-2brx-j3az |
|
| 3 |
| vulnerability |
VCID-9mh5-8n3y-93c8 |
|
| 4 |
| vulnerability |
VCID-ant9-spg8-1ug5 |
|
| 5 |
| vulnerability |
VCID-arjb-mbgt-97dh |
|
| 6 |
| vulnerability |
VCID-g6wm-gjsy-7fdt |
|
| 7 |
| vulnerability |
VCID-qnk5-9jfz-5bhh |
|
| 8 |
| vulnerability |
VCID-rxu6-ccns-m3fk |
|
| 9 |
| vulnerability |
VCID-sq7n-ehxa-rbb9 |
|
| 10 |
| vulnerability |
VCID-u1bz-wj83-nbbt |
|
| 11 |
| vulnerability |
VCID-vc1g-tqkt-w7gt |
|
| 12 |
| vulnerability |
VCID-ve54-aaqx-xkck |
|
| 13 |
| vulnerability |
VCID-x2ne-qxnz-rkem |
|
| 14 |
| vulnerability |
VCID-xbzy-s3xw-y7ey |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/typo3/cms-core@12.4.8 |
|
|
| aliases |
CVE-2023-47127, GHSA-3vmm-7h4j-69rm
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wutq-k9ph-zyab |
|
| 31 |
| url |
VCID-x2ne-qxnz-rkem |
| vulnerability_id |
VCID-x2ne-qxnz-rkem |
| summary |
TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-0859, GHSA-7vp9-x248-9vr9
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-x2ne-qxnz-rkem |
|
| 32 |
| url |
VCID-xbzy-s3xw-y7ey |
| vulnerability_id |
VCID-xbzy-s3xw-y7ey |
| summary |
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this vulnerability. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-25119, GHSA-h47m-3f78-qp9g
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xbzy-s3xw-y7ey |
|
|
|---|