Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
184 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Problem Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it was possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular form item (known as formDefinitionOverrides) and a valid backend user account with access to the form module are needed to exploit this vulnerability. Solution Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. References TYPO3-CORE-SA-2022-015
Recommended action: Upgrade to 12.1.1, 11.5.20 or 10.4.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. Solution Update to TYPO3 versions 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. References TYPO3-CORE-SA-2022-014
Recommended action: Upgrade to 12.1.1, 11.5.20 or 10.4.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary. Solution Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above. References TYPO3-CORE-SA-2022-013
Recommended action: Upgrade to 12.1.1, 11.5.20 or 10.4.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem Requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in TYPO3-CORE-SA-2021-005 (CVE-2021-21359). Solution Update to TYPO3 versions 9.5.38 ELTS, 10.4.33 or 11.5.20 that fix the problem described above. References TYPO3-CORE-SA-2022-012
Recommended action: Upgrade to 11.5.20 or 10.4.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem Due to a parsing issue in the upstream package masterminds/html5, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. Besides that, the upstream package masterminds/html5 provides HTML raw text elements (script, style, noframes, noembed and iframe) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that's why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting. Solution Update to typo3/html-sanitizer versions 1.5.0 or 2.1.1 that fix the problem described.
Recommended action: Upgrade to 12.1.1, 11.5.20 or 10.4.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.7) Problem Due to a parsing issue in upstream package masterminds/html5, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows to by-pass the cross-site scripting mechanism of typo3/html-sanitizer. Solution Update to typo3/html-sanitizer versions 1.0.7 or 2.0.16 that fix the problem described. Credits Thanks to David Klein who reported this issue, and to TYPO3 security team member Oliver Hader who fixed the issue.
Recommended action: Upgrade to 11.5.16 or 10.4.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C (5.5) Problem Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is the same as described in TYPO3-CORE-SA-2021-005 (CVE-2021-21359). A regression, introduced during TYPO3 v11 development, led to this situation. Solution Update to TYPO3 version 11.5.16 that fixes the problem described above. Credits Thanks to Rik Willems who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2022-006
Recommended action: Upgrade to 11.5.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C (4.9) Problem It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new MimicServiceInterface::mimicAuthUser, which simulates corresponding times regular processing would usually take. Solution Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above. Credits Thanks to Vautia who reported this issue and to TYPO3 core & security team members Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2022-007 Vulnerability Report on huntr.dev (embargoed +30 days)
Recommended action: Upgrade to 11.5.16 or 10.4.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C (5.0) Problem It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Solution Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem described above. Credits Thanks to Ingo Fabbri who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue. References TYPO3-CORE-SA-2022-008
Recommended action: Upgrade to 11.5.16 or 10.4.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.0) Problem It has been discovered that the FileDumpController (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Solution Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above. Credits Thanks to Vautia who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2022-009 Vulnerability Report on huntr.dev (embargoed +30 days)
Recommended action: Upgrade to 11.5.16 or 10.4.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.1) Problem It has been discovered that the f:asset.css view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Solution Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem described above. Credits Thanks to TYPO3 contributor member Frank Nägler who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2022-010
Recommended action: Upgrade to 11.5.16 or 10.4.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C (5.6) Problem Admin Tool sessions initiated via the TYPO3 backend user interface have not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. Solution Update to TYPO3 versions 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above. Credits Thanks to Kien Hoang who reported this issue and to TYPO3 framework merger Ralf Zimmermann and TYPO3 security member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2022-005
Recommended action: Upgrade to 11.5.11 or 10.4.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.9) Problem User submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. Solution Update to TYPO3 versions 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above. Credits Thanks to Christian Seifert who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue. References TYPO3-CORE-SA-2022-004
Recommended action: Upgrade to 11.5.11 or 10.4.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.9) Problem It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. Solution Update to TYPO3 versions 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above. Credits Thanks to Gabe Troyan who reported and fixed the issue. References TYPO3-CORE-SA-2022-003
Recommended action: Upgrade to 11.5.11 or 10.4.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C (4.9) Problem It has been discovered that system internal credentials or keys (e.g. database credentials) have been logged as plaintext in exception handlers, when logging the complete exception stack trace. Solution Update to TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above. Credits Thanks to Marco Huber who reported this issue and to TYPO3 security member Torben Hansen who fixed the issue. References TYPO3-CORE-SA-2022-002
Recommended action: Upgrade to 11.5.11 or 10.4.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C (4.0) Problem The export functionality fails to limit the result set to allowed columns of a particular database table. This allows authenticated users to export internal details of database tables to which they already have access. Solution Update to TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users. ℹ️ Strong security defaults - Manual actions required Following User TSconfig setting would allow using the export functionality for particular users: Credits Thanks to TYPO3 core merger Lina Wolf who reported this issue and to TYPO3 security member Torben Hansen who fixed the issue. References TYPO3-CORE-SA-2022-001
Recommended action: Upgrade to 11.5.11 or 10.4.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.
Recommended action: Upgrade to 9.5.8 or 8.7.27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.
Recommended action: Upgrade to 9.5.8 or 8.7.27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 is susceptible to remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick. For a successful exploit, the GhostScript binary gs must be available on the server system.
Recommended action: Upgrade to 9.5.6 or 8.7.25 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 included a vulnerable external component, which could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
Recommended action: Upgrade to 7.2.0 or 6.2.39 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
Recommended action: Upgrade to 10.2.2, 9.5.12 or 8.7.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
Recommended action: Upgrade to 10.2.2, 9.5.12 or 8.7.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sysaction installed, with a valid backend user who has limited privileges.
Recommended action: Upgrade to 10.2.1, 9.5.12 or 8.7.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The jumpUrl (aka access tracking) implementation in tslib/class.tslibfe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified vectors.
Recommended action: Upgrade to 4.4.4, 4.3.7 or 4.2.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 4.6.7, 4.5.14 or 4.4.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.