Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
126 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
11.5.379.5.4812.4.1510.4.4513.1.1· Vendor fix available
Issue
Problem Failing to properly encode user-controlled values in file entities, the ShowImageController (eID txcmsshowpic) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described. Credits Thanks to TYPO3 security team member Torben Hansen who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2024-009
Recommended action: Upgrade to 13.1.1, 12.4.15, 11.5.37 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.5.379.5.4812.4.1510.4.4513.1.1· Vendor fix available
Issue
Problem The form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described. Credits Thanks to TYPO3 core & security team member Benjamin Franzke who reported and fixed the issue. References TYPO3-CORE-SA-2024-008
Recommended action: Upgrade to 13.1.1, 12.4.15, 11.5.37 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem The history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. Solution Update to TYPO3 version 13.1.1 that fixes the problem described. Credits Thanks to TYPO3 core team member Andreas Kienast who reported this issue and to TYPO3 core & security team Benjamin Franzke who fixed the issue. References TYPO3-CORE-SA-2024-007
Recommended action: Upgrade to 13.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
8.7.5712.4.119.5.4610.4.4311.5.3513.0.1· Vendor fix available
Issue
Problem Several settings in the Install Tool for configuring the path to system binaries were vulnerable to code execution. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. The corresponding change for this advisory involves enforcing the known disadvantages described in TYPO3-PSA-2020-002: Protecting Install Tool with Sudo Mode. Solution Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. Credits Thanks to Rickmer Frier & Daniel Jonka who reported this issue and to TYPO3 core & security team member Benjamin Franzke who fixed the issue. References TYPO3-CORE-SA-2024-002
Recommended action: Upgrade to 13.0.1, 12.4.11, 11.5.35 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
8.7.5712.4.119.5.4610.4.4311.5.3513.0.1· Vendor fix available
Issue
Problem Configurable storages using the local driver of the File Abstraction Layer (FAL) could be configured to access directories outside of the root directory of the corresponding project. The system setting in BE/lockRootPath was not evaluated by the file abstraction layer component. An administrator-level backend user account is required to exploit this vulnerability. Solution Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. ℹ️ Strong security defaults - Manual actions required see Important: #102800 changelog Assuming that a web project is located in the directory /var/www/example.org (the "project root path" for Composer-based projects) and the publicly accessible directory is located at /var/www/example.org/public (the "public root path"), accessing resources via the File Abstraction Layer component is limited to the mentioned directories. To grant additional access to directories, they must be…
Recommended action: Upgrade to 13.0.1, 12.4.11, 11.5.35 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
8.7.5712.4.119.5.4610.4.4311.5.3513.0.1· Vendor fix available
Issue
Problem Entities of the File Abstraction Layer (FAL) could be persisted directly via DataHandler. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account. Solution Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. ℹ️ Strong security defaults - Manual actions required When persisting entities of the File Abstraction Layer directly via DataHandler, sysfile entities are now denied by default, and sysfilereference & sysfilemetadata entities are not permitted to reference files in the fallback storage anymore. When importing data from secure origins, this must be explicitly enabled in the corresponding…
Recommended action: Upgrade to 13.0.1, 12.4.11, 11.5.35 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
8.7.5712.4.119.5.4610.4.4311.5.3513.0.1· Vendor fix available
Issue
Problem The TYPO3-specific t3:// URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Solution Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. Credits Thanks to Richie Lee who reported this issue and to TYPO3 core & security team member Benjamin Franzke who fixed the issue. References TYPO3-CORE-SA-2024-005
Recommended action: Upgrade to 13.0.1, 12.4.11, 11.5.35 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
8.7.5712.4.119.5.4610.4.4311.5.3513.0.1· Vendor fix available
Issue
Problem The plaintext value of $GLOBALS['SYS']['encryptionKey'] was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. Solution Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. Credits Thanks to TYPO3 core & security team member Benjamin Franzke who fixed the issue. References TYPO3-CORE-SA-2024-004
Recommended action: Upgrade to 13.0.1, 12.4.11, 11.5.35 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
8.7.5712.4.119.5.4610.4.4311.5.3513.0.1· Vendor fix available
Issue
Problem Password hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed attackers to crack the plaintext password using brute force techniques. Exploiting this vulnerability requires a valid backend user account. Solution Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. Credits Thanks to the TYPO3 framework merger Christian Kuhn and external security researchers Maximilian Beckmann, Klaus-Günther Schmidt who reported this issue, and TYPO3 security team member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2024-003
Recommended action: Upgrade to 13.0.1, 12.4.11, 11.5.35 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
8.7.5510.4.4111.5.3312.4.89.5.44· Vendor fix available
Issue
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/E:X/RL:O/RC:C (4.0) Problem Given that there are at least two different sites in the same TYPO3 installation - for instance first.example.org and second.example.com - then a session cookie generated for the first site can be reused on the second site without requiring additional authentication. This vulnerability primarily affects the frontend of the website. It's important to note that exploiting this vulnerability requires a valid user account. Solution Update to TYPO3 versions 8.7.55 ELTS, 9.5.44 ELTS, 10.4.41 ELTS, 11.5.33, 12.4.8 that fix the problem described above. Credits Thanks to Rémy Daniel who reported this issue, and to TYPO3 core & security team member Benjamin Franzke who fixed the issue. References TYPO3-CORE-SA-2023-006
Recommended action: Upgrade to 12.4.8, 11.5.33, 10.4.41 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C (3.5) Problem In multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available. Solution Update to TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 that fix the problem described above. ℹ️ Strong security defaults - Manual actions required Resolving sites by the id and L HTTP query parameters is now denied per default. However, it is still allowed to resolve a particular page by e.g. https://example.org/?id=123&L=0 - as long as the page-id 123 is in the scope of the site configured for the base-url example.org. The new feature flag security.frontend.allowInsecureSiteResolutionByQueryParameters - which is disabled per default - can be used to reactivate the previous…
Recommended action: Upgrade to 12.4.4, 11.5.30, 10.4.39 or 9.5.42 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
12.2.08.7.519.5.4010.4.3611.5.23· Vendor fix available
Issue
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:F/RL:O/RC:C (8.2) Problem TYPO3 core component GeneralUtility::getIndpEnv() uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In combination with the TypoScript setting config.absRefPrefix=auto, attackers can inject malicious HTML code into pages that have not yet been rendered and cached. As a result, injected values would be cached and delivered to other website visitors (persisted cross-site scripting). Individual code which relies on the resolved value of GeneralUtility::getIndpEnv('SCRIPTNAME') and corresponding usages (as shown below) are vulnerable as well. - GeneralUtility::getIndpEnv('PATHINFO') - GeneralUtility::getIndpEnv('SCRIPTNAME') - GeneralUtility::getIndpEnv('TYPO3REQUESTDIR') - GeneralUtility::getIndpEnv('TYPO3REQUESTSCRIPT') - GeneralUtility::getIndpEnv('TYPO3SITEPATH') - GeneralUtility::getIndpEnv('TYPO3SITESCRIPT') -…
Recommended action: Upgrade to 12.2.0, 11.5.23, 10.4.36 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C (5.3) Problem Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. Solution Update to TYPO3 versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. Credits Thanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue. References TYPO3-CORE-SA-2022-016
Recommended action: Upgrade to 12.1.1, 11.5.20, 10.4.33 or 9.5.38 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
9.5.3811.5.2010.4.3312.1.18.7.49· Vendor fix available
Issue
Problem Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it was possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular form item (known as formDefinitionOverrides) and a valid backend user account with access to the form module are needed to exploit this vulnerability. Solution Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. References TYPO3-CORE-SA-2022-015
Recommended action: Upgrade to 12.1.1, 11.5.20, 10.4.33 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. Solution Update to TYPO3 versions 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. References TYPO3-CORE-SA-2022-014
Recommended action: Upgrade to 12.1.1, 11.5.20 or 10.4.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
9.5.3811.5.2010.4.3312.1.18.7.49· Vendor fix available
Issue
Problem Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. Solution Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. References TYPO3-CORE-SA-2022-013
Recommended action: Upgrade to 12.1.1, 11.5.20, 10.4.33 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem Requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in TYPO3-CORE-SA-2021-005 (CVE-2021-21359). Solution Update to TYPO3 versions 9.5.38 ELTS, 10.4.33 or 11.5.20 that fix the problem described above. References TYPO3-CORE-SA-2022-012
Recommended action: Upgrade to 11.5.20, 10.4.33 or 9.5.38 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.7) Problem Due to a parsing issue in upstream package masterminds/html5, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows to by-pass the cross-site scripting mechanism of typo3/html-sanitizer. Solution Update to typo3/html-sanitizer versions 1.0.7 or 2.0.16 that fix the problem described. Credits Thanks to David Klein who reported this issue, and to TYPO3 security team member Oliver Hader who fixed the issue.
Recommended action: Upgrade to 11.5.16 or 10.4.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C (5.5) Problem Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is the same as described in TYPO3-CORE-SA-2021-005 (CVE-2021-21359). A regression, introduced during TYPO3 v11 development, led to this situation. Solution Update to TYPO3 version 11.5.16 that fixes the problem described above. Credits Thanks to Rik Willems who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2022-006
Recommended action: Upgrade to 11.5.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.5.168.7.4810.4.327.6.589.5.37· Vendor fix available
Issue
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C (4.9) Problem It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new MimicServiceInterface::mimicAuthUser, which simulates corresponding times regular processing would usually take. Solution Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above. Credits Thanks to Vautia who reported this issue and to TYPO3 core & security team members Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2022-007 Vulnerability Report on huntr.dev (embargoed +30 days)
Recommended action: Upgrade to 11.5.16, 10.4.32, 9.5.37 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C (5.0) Problem It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Solution Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem described above. Credits Thanks to Ingo Fabbri who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue. References TYPO3-CORE-SA-2022-008
Recommended action: Upgrade to 11.5.16 or 10.4.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.5.168.7.4810.4.327.6.589.5.37· Vendor fix available
Issue
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.0) Problem It has been discovered that the FileDumpController (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Solution Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above. Credits Thanks to Vautia who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2022-009 Vulnerability Report on huntr.dev (embargoed +30 days)
Recommended action: Upgrade to 11.5.16, 10.4.32, 9.5.37 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.1) Problem It has been discovered that the f:asset.css view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Solution Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem described above. Credits Thanks to TYPO3 contributor member Frank Nägler who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2022-010
Recommended action: Upgrade to 11.5.16 or 10.4.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.5.168.7.4810.4.327.6.589.5.37· Vendor fix available
Issue
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.7) Problem Due to a parsing issue in upstream package masterminds/html5, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows to by-pass the cross-site scripting mechanism of typo3/html-sanitizer. Solution Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above. Credits Thanks to David Klein who reported this issue, and to TYPO3 security team member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2022-011 GHSA-47m6-46mj-p235
Recommended action: Upgrade to 11.5.16, 10.4.32, 9.5.37 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C (5.6) Problem Admin Tool sessions initiated via the TYPO3 backend user interface have not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. Solution Update to TYPO3 versions 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above. Credits Thanks to Kien Hoang who reported this issue and to TYPO3 framework merger Ralf Zimmermann and TYPO3 security member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2022-005
Recommended action: Upgrade to 11.5.11, 10.4.29 or 9.5.35 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.