GitHub Advisoryadvisory · Packagist

GHSA-hjx5-v9xg-7h25 TYPO3 Denial of Service in Frontend Record Registration

HIGH Published 2024-05-30 Modified 2024-05-30 Official page ↗
Ecosystem
Packagist
Packages
typo3/cms-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2024-05-30

Affected packages

• Packagist typo3/cms-core: >= 8.0.0, < 8.7.21 → fixed in 8.7.21 • Packagist typo3/cms-core: >= 7.0.0, < 7.6.32 → fixed in 7.6.32

Description

TYPO3’s built-in record registration functionality (aka “basic shopping cart”) using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual session-data records in the database.

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References