GitHub Advisoryadvisory · Packagist
GHSA-v6mw-h7w6-59w3 TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
MEDIUM
Official page ↗
- Aliases
- CVE-2024-34356
- Ecosystem
- Packagist
- Packages
- typo3/cms-core
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2024-05-14
Affected packages
• Packagist typo3/cms-core: >= 9.0.0, < 9.5.48 → fixed in 9.5.48
• Packagist typo3/cms-core: >= 10.0.0, < 10.4.45 → fixed in 10.4.45
• Packagist typo3/cms-core: >= 11.0.0, < 11.5.37 → fixed in 11.5.37
• Packagist typo3/cms-core: >= 12.0.0, < 12.4.15 → fixed in 12.4.15
• Packagist typo3/cms-core: >= 13.0.0, < 13.1.1 → fixed in 13.1.1
Description
Problem
The form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module.
Solution
Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described.
Credits
Thanks to TYPO3 core & security team member Benjamin Franzke who reported and fixed the issue.
References
• TYPO3-CORE-SA-2024-008
Related
Alias · CVE (1)
- CVE-2024-34356 TYPO3 is an enterprise content management system. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-v6mw-h7w6-59w3 web
- https://nvd.nist.gov/vuln/detail/CVE-2024-34356 advisory
- https://github.com/TYPO3/typo3/commit/2832e2f51f929aeddb5de7d667538a33ceda8156 web
- https://github.com/TYPO3/typo3/commit/d0393a879a32fb4e3569acad6bdb5cda776be1e5 web
- https://github.com/TYPO3/typo3/commit/e95a1224719efafb9cab2d85964f240fd0356e64 web
- https://github.com/TYPO3/typo3 package
- https://typo3.org/security/advisory/typo3-core-sa-2024-008 web