Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
184 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Failing to properly validate user input, the form component is susceptible to Arbitrary File Disclosure. A valid backend user account is needed to exploit this vulnerability. Only forms are vulnerable, which contain upload fields.
Recommended action: Upgrade to 6.2.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode user input, the CSS styled content component is susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript.
Recommended action: Upgrade to 7.6.4 or 6.2.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
All XML processing within the TYPO3 CMS are vulnerable to XEE processing. This can lead to load internal and/or external (file) content within an XML structure. Furthermore it is possible to inject arbitrary files for an XML Denial of Service attack. For more information on that topic see https://www.owasp.org/index.php/XMLExternalEntity(XXE)Processing.
Recommended action: Upgrade to 7.6.4 or 6.2.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode incoming data, the bookmark toolbar is susceptible to Cross-Site Scripting.
Recommended action: Upgrade to 6.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to sanitize content from unauthenticated website visitors, the form component is susceptible to Cross-Site Scripting.
Recommended action: Upgrade to 6.2.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to sanitize content from editors, the legacy form component is susceptible to Cross-Site Scripting. A valid editor account with access to a form content element is required to exploit this vulnerability.
Recommended action: Upgrade to 6.2.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to sanitize content from editors, the link validator component is susceptible to Cross-Site Scripting. A valid editor account with access to content which is scanned by the link validator component is required to exploit this vulnerability.
Recommended action: Upgrade to 7.6.3 or 6.2.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode editor input, several frontend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML.
Recommended action: Upgrade to 7.6.1 or 6.2.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw in the database escaping API results in a SQL injection vulnerability when extension dbal is enabled and configured for MySQL passthrough mode in its extension configuration. All queries which use the DatabaseConnection::sqlquery are vulnerable, even if arguments were properly escaped with DatabaseConnection::quoteStr beforehand.
Recommended action: Upgrade to 6.2.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode editor input, the search result view of indexedsearch is susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML.
Recommended action: Upgrade to 6.2.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The flashplayer misses to validate flash and image files. Therefore it is possible to embed flash videos from external domains.
Recommended action: Upgrade to 6.2.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode user input, several backend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript.
Recommended action: Upgrade to 7.6.1 or 6.2.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation.
Recommended action: Upgrade to 7.4.0 or 6.2.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The backend login has a basic brute force protection implementation which pauses for 5 seconds if wrong credentials are given. This pause however could be bypassed by forging a special request, making brute force attacks on backend editor credentials more feasible.
Recommended action: Upgrade to 7.3.1 or 6.2.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered, that editors with access to the file list module could list all files names and folder names in the root directory of a TYPO3 installation. Modification of files, listing further nested directories or retrieving file contents was not possible. A valid backend user account is needed to exploit this vulnerability.
Recommended action: Upgrade to 7.3.1 or 6.2.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that link tags generated by typolink functionality in the website's frontend are vulnerable to cross-site scripting - values being assigned to HTML attributes have not been parsed correctly. A valid backend user account is needed to exploit this vulnerability. As second and separate vulnerability in the filelist module of the backend user interface has been referenced with this advisory as well. Error messages being shown after using a malicious name for renaming a file are not propery encoded, thus vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability.
Recommended action: Upgrade to 7.3.1 or 6.2.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that TYPO3 is susceptible to session fixation. If a user authenticates while anonymous session data is present, the session id is not changed. This makes it possible for attackers to generate a valid session id, trick users into using this session id (e.g. by leveraging a different Cross-Site Scripting vulnerability) and then maybe getting access to an authenticated session.
Recommended action: Upgrade to 7.3.1 or 6.2.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.
Recommended action: Upgrade to 7.3.1 or 6.2.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A request URL with arbitrary arguments, but still pointing to the home page of a TYPO3 installation can be cached if the configuration option config.prefixLocalAnchors is used with the values "all" or "cached". The impact of this vulnerability is that unfamiliar looking links to the home page can end up in the cache, which leads to a reload of the page in the browser when section links are followed by web page visitors, instead of just directly jumping to the requested section of the page. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page.
Recommended action: Upgrade to 7.0.2 or 6.2.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly validate the HTTP host-header TYPO3 CMS is susceptible to host spoofing. TYPO3 uses the HTTP host-header to generate absolute URLs in several places like 404 handling, http(s) enforcement, password reset links and many more. Since the host header itself is provided by the client it can be forged to any value, even in a name based virtual hosts environment. A blog post describes this problem in great detail.
Recommended action: Upgrade to 6.2.3, 6.1.9, 4.7.19 or 4.5.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The swiftmailer library in use allows to execute arbitrary shell commands if the "From" header comes from a non-trusted source and no "Return-Path" is configured. Affected are only TYPO3 installation the configuration option is set to "sendmail". Installations with the default configuration are not affected.
Recommended action: Upgrade to 6.2.6, 6.1.12, 4.7.20 or 4.5.37 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to a too loose type check in an API method, attackers could bypass the directory traversal check by providing an invalid UTF-8 encoding sequence.
Recommended action: Upgrade to 8.4.1, 7.6.13 or 6.2.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:F/RL:O/RC:C (8.2) Problem TYPO3 core component GeneralUtility::getIndpEnv() uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In combination with the TypoScript setting config.absRefPrefix=auto, attackers can inject malicious HTML code into pages that have not yet been rendered and cached. As a result, injected values would be cached and delivered to other website visitors (persisted cross-site scripting). Individual code which relies on the resolved value of GeneralUtility::getIndpEnv('SCRIPTNAME') and corresponding usages (as shown below) are vulnerable as well. - GeneralUtility::getIndpEnv('PATHINFO') - GeneralUtility::getIndpEnv('SCRIPTNAME') - GeneralUtility::getIndpEnv('TYPO3REQUESTDIR') - GeneralUtility::getIndpEnv('TYPO3REQUESTSCRIPT') - GeneralUtility::getIndpEnv('TYPO3SITEPATH') - GeneralUtility::getIndpEnv('TYPO3SITESCRIPT') -…
Recommended action: Upgrade to 12.2.0, 11.5.23 or 10.4.35 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the fechangepwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
Recommended action: Upgrade to 3.0.3 or 2.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C (5.3) Problem Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. Solution Update to TYPO3 versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. Credits Thanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue. References TYPO3-CORE-SA-2022-016
Recommended action: Upgrade to 12.1.1, 11.5.20 or 10.4.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.