Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

typo3/cms-extensionmanager

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5PackagistPublished

    TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery

    CVE-2024-55921 · GHSA-4g52-pq8j-6qv5

    Affected
    • Packagist typo3/cms-extensionmanager >= 10.0.0, <= 10.4.47; >= 11.0.0, <= 11.5.41; >= 12.0.0, <= 12.4.24; >= 13.0.0, <= 13.4.2
    Fixed in
    10.4.4813.4.311.5.4212.4.25· Vendor fix available
    Issue
    Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: the user opens a malicious link, such as one sent via email. the user visits a compromised or manipulated website while the following settings are misconfigured: + security.backend.enforceReferrer feature is disabled, + BE/cookieSameSite configuration is set to lax or none The vulnerability in the affected downstream component “Extension Manager Module” allows attackers to retrieve and…

    Recommended action: Upgrade to 13.4.3, 12.4.25, 11.5.42 or 10.4.48 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →