Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
126 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Backend API configuration using Page TSconfig is vulnerable to arbitrary code execution and cross-site scripting. TSconfig fields of page properties in backend forms can be used to inject malicious sequences. Field tsconfigincludes is vulnerable to directory traversal leading to same scenarios as having direct access to TSconfig settings. A valid backend user account having access to modify values for fields pages.TSconfig and pages.tsconfigincludes is needed in order to exploit this vulnerability.
Recommended action: Upgrade to 9.5.8 or 8.7.27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that the Import/Export module is susceptible to broken access control. Regular backend users have access to import functionality which usually only is available to admin users or users having User TSconfig setting options.impexp.enableImportForNonAdminUser explicitly enabled. Database content to be imported however was correctly checked against users’ permissions and not affected. However it was possible to upload files by-passing restrictions of the file abstraction layer (FAL) - however this did not affect executable files which have been correctly secured by fileDenyPattern. Currently the only known vulnerability is to directly inject .form.yaml files which could be used to trigger the vulnerability of TYPO3-CORE-SA-2018-003 (privilege escalation & SQL injection) - which requires the Form Framework (ext:form) being available on an according website. CVSSv3 scoring is based on this scenario. A valid backend user account is needed in order to exploit this…
Recommended action: Upgrade to 9.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data.
Recommended action: Upgrade to 9.5.8 or 8.7.27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The element information component used to display properties of a certain record is susceptible to information disclosure. The list of references from or to the record is not properly checked for the backend user’s permissions. A valid backend user account is needed in order to exploit this vulnerability.
Recommended action: Upgrade to 9.5.8 or 8.7.27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that login failures have been logged on the default stream with log level "warning" including plain-text user credentials.
Recommended action: Upgrade to 9.5.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that mechanisms used for configuration of RequireJS package loading are susceptible to information disclosure. This way a potential attack can retrieve additional information about installed system and third party extensions.
Recommended action: Upgrade to 9.5.4 or 8.7.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered backend users not having read access to specific pages still could see them in the page tree which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.
Recommended action: Upgrade to 9.5.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability.
Recommended action: Upgrade to 9.5.6 or 8.7.25 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode user input, frontend forms handled by the form framework (system extension “form”) are vulnerable to cross-site scripting.
Recommended action: Upgrade to 9.5.4 or 8.7.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode information from external sources, language pack handling in the install tool is vulnerable to cross-site scripting.
Recommended action: Upgrade to 9.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to missing file extensions in $GLOBALS['TYPO3CONFVARS']['BE'][‘fileDenyPattern’], backend users are allowed to upload .phar, .shtml, .pl or .cgi files which can be executed in certain web server setups. A valid backend user account is needed in order to exploit this vulnerability. Derivatives of Debian GNU Linux are handling .phar files as PHP applications since PHP 7.1 (for unofficial packages) and PHP 7.2 (for official packages). The file extension .shtml is bound to server side includes which are not enabled per default in most common Linux based distributions. File extension .pl and .cgi require additional handlers to be configured which is also not the case in most common distributions (except for /cgi-bin/ location).
Recommended action: Upgrade to 9.5.4 or 8.7.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that backend users having limited access to specific languages are capable of modifying and creating pages in the default language which actually should be disallowed. A valid backend user account is needed in order to exploit this vulnerability.
Recommended action: Upgrade to 8.7.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in order to reflect changed configuration possibilities. However, this leads to persisting the current state as well, which can result into some of the following: - account contains empty login credentials (username and/or password) - account is incomplete and contains weak credentials (username and/or password) Albeit the functionality provided by the TYPO3 core cannot be used either with empty usernames or empty passwords, it still can be a severe vulnerability to custom authentication service implementations. This weakness cannot be directly exploited and requires interaction on purpose by some backend user having according privileges.
Recommended action: Upgrade to 9.5.4 or 8.7.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3’s built-in record registration functionality (aka “basic shopping cart”) using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual session-data records in the database.
Recommended action: Upgrade to 8.7.21 or 7.6.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Online Media Asset Handling (.youtube and .vimeo files) in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a dysfunctional backend component. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
Recommended action: Upgrade to 9.5.2, 8.7.21 or 7.6.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Install Tool exposes the current TYPO3 version number to non-authenticated users.
Recommended action: Upgrade to 9.5.2, 8.7.21 or 7.6.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool.
Recommended action: Upgrade to 9.5.2, 8.7.21 or 7.6.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile. Template patterns that are affected are - ###FEUSER[fieldName] using system extension felogin - <!--###USERNAME###-- for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAMEsubstToken)
Recommended action: Upgrade to 9.5.2, 8.7.21 or 7.6.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.
Recommended action: Upgrade to 9.5.2, 8.7.21 or 7.6.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that the Form Framework (system extension form) is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package yaml, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting yaml.decodephp enabled is needed to exploit this vulnerability (which is the default value according to PHP documentation).
Recommended action: Upgrade to 9.3.1 or 8.7.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode user input, online media asset rendering (.youtube and .vimeo files) is vulnerable to cross-site scripting. A valid backend user account or write access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.
Recommended action: Upgrade to 9.5.2 or 8.7.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly dissociate system related configuration from user generated configuration, the Form Framework (system extension "form") is vulnerable to SQL injection and Privilege Escalation. Basically instructions can be persisted to a form definition file that were not configured to be modified - this applies to definitions managed using the form editor module as well as direct file upload using the regular file list module. A valid backend user account as well as having system extension form activated are needed in order to exploit this vulnerability.
Recommended action: Upgrade to 9.3.2 or 8.7.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way, Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability. In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit has been identified so far.
Recommended action: Upgrade to 9.3.2, 8.7.17 or 7.6.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component) is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance. In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden when using MD5 as the default hashing algorithm by just knowing a valid username. Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.
Recommended action: Upgrade to 9.3.2, 8.7.17 or 7.6.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.5.379.5.4812.4.1510.4.4513.1.1· Vendor fix available
Issue
Problem The ShowImageController (eID txcmsshowpic) lacks a cryptographic HMAC-signature on the frame HTTP query parameter (e.g. /index.php?eID=txcmsshowpic?file=3&...&frame=12345). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described. ℹ️ Strong security defaults - Manual actions required The frame HTTP query parameter is now ignored, since it could not be used by core APIs. The new feature flag security.frontend.allowInsecureFrameOptionInShowImageController – which is disabled per default – can be used to reactivate the previous behavior. Credits Thanks to TYPO3 security team member Torben Hansen who reported this issue and to TYPO3 core & security team members Benjamin Mack and Benjamin Franzke who fixed the issue. References TYPO3-CORE-SA-2024-010
Recommended action: Upgrade to 13.1.1, 12.4.15, 11.5.37 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.