Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

typo3/cms-lowlevel

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3PackagistPublished

    TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery

    CVE-2024-55945 · GHSA-8mv3-37rc-pvxj

    Affected
    • Packagist typo3/cms-lowlevel >= 11.0.0, <= 11.5.41
    Fixed in
    11.5.42· Vendor fix available
    Issue
    Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: the user opens a malicious link, such as one sent via email. the user visits a compromised or manipulated website while the following settings are misconfigured: + security.backend.enforceReferrer feature is disabled, + BE/cookieSameSite configuration is set to lax or none The vulnerability in the affected downstream component “DB Check Module” allows attackers to manipulate data through…

    Recommended action: Upgrade to 11.5.42 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →