Search for packages
Package details: pkg:composer/typo3/cms-backend@12.4.21
purl pkg:composer/typo3/cms-backend@12.4.21
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-ubuj-dxgj-n3ha
Aliases:
CVE-2025-47941
GHSA-744g-7qm9-hjh9
The TYPO3 CMS Backend has Broken Authentication in Backend MFA ### Problem The multifactor authentication (MFA) dialog presented during backend login can be bypassed due to insufficient enforcement of access restrictions on all backend routes. Successful exploitation requires valid backend user credentials, as MFA can only be bypassed after successful authentication. ### Solution Update to TYPO3 versions 12.4.31 LTS, 13.4.12 LTS that fix the problem described. ### Credits Thanks to Jens Jacobsen and Y. Kahveci for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it.
12.4.31
Affected by 0 other vulnerabilities.
13.4.12
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (2)
Vulnerability Summary Aliases
VCID-bccy-q51m-b3gy Denial of Service in TYPO3 Bookmark Toolbar ### Problem Due to insufficient input validation, manipulated data saved in the bookmark toolbar of the backend user interface causes a general error state, blocking further access to the interface. Exploiting this vulnerability requires an administrator-level backend user account. ### Solution Update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described. ### Credits Thanks to Hendrik Eichner who reported this issue and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke who fixed the issue. ### References * [TYPO3-CORE-SA-2024-011](https://typo3.org/security/advisory/typo3-core-sa-2024-001) CVE-2024-34537
GHSA-ffcv-v6pw-qhrp
VCID-nqe1-b3zv-pufk Information Disclosure in TYPO3 Page Tree ### Problem Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages. ### Solution Update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described. ### Credits Thanks to Peter Schuler who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue. CVE-2024-47780
GHSA-rf5m-h8q9-9w6q

Date Actor Action Vulnerability Source VulnerableCode Version
2025-07-03T19:27:13.783302+00:00 GitLab Importer Affected by VCID-ubuj-dxgj-n3ha https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-47941.yml 37.0.0
2025-07-03T13:57:16.797463+00:00 GitLab Importer Fixing VCID-bccy-q51m-b3gy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2024-34537.yml 36.1.3
2025-07-03T13:57:16.664711+00:00 GitLab Importer Fixing VCID-nqe1-b3zv-pufk https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2024-47780.yml 36.1.3
2025-07-01T14:35:38.319966+00:00 GHSA Importer Fixing VCID-bccy-q51m-b3gy https://github.com/advisories/GHSA-ffcv-v6pw-qhrp 36.1.3
2025-07-01T14:35:37.088302+00:00 GHSA Importer Fixing VCID-nqe1-b3zv-pufk https://github.com/advisories/GHSA-rf5m-h8q9-9w6q 36.1.3
2025-07-01T12:08:49.674300+00:00 GithubOSV Importer Fixing VCID-bccy-q51m-b3gy https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-ffcv-v6pw-qhrp/GHSA-ffcv-v6pw-qhrp.json 36.1.3
2025-07-01T12:08:37.423056+00:00 GithubOSV Importer Fixing VCID-nqe1-b3zv-pufk https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-rf5m-h8q9-9w6q/GHSA-rf5m-h8q9-9w6q.json 36.1.3