Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
184 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The t3libdiv::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
Recommended action: Upgrade to 4.6.7, 4.5.14 or 4.4.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."
Recommended action: Upgrade to 4.6.7, 4.5.14 or 4.4.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature."
Recommended action: Upgrade to 6.1.7, 6.0.12, 4.7.17 or 4.5.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.
Recommended action: Upgrade to 6.1.4 or 6.0.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL.
Recommended action: Upgrade to 4.7.6, 4.6.14 or 4.5.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.
Recommended action: Upgrade to 6.1.3 or 6.0.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors.
Recommended action: Upgrade to 6.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a password hash.
Recommended action: Upgrade to 6.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to respect user groups of logged in users when caching queries, Extbase is susceptible to information disclosure. The query caching (introduced in Extbase 6.2) used to cache queries that query results for a specific user group were presented to a different group.
Recommended action: Upgrade to 6.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
6.0.156.2.94.7.214.5.394.6.197.0.26.1.13· Vendor fix available
Issue
Problem Description: A request URL with arbitrary arguments, but still pointing to the home page of a TYPO3 installation can be cached if the configuration option config.prefixLocalAnchors is used with the values "all" or "cached". The impact of this vulnerability is that unfamiliar looking links to the home page can end up in the cache, which leads to a reload of the page in the browser when section links are followed by web page visitors, instead of just directly jumping to the requested section of the page. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. Solution: Removing the configuration options config.prefixLocalAnchors (and optionally also config.baseUrl) in favor of config.absRefPrefix Credits: Thanks to Gernot Leitgab who discovered and reported the vulnerability.
Recommended action: Upgrade to 7.0.2, 6.2.9, 6.1.13 or 4 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexedsearch) component in TYPO3 6.2.x before 6.2.16 allows remote authenticated editors to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 6.2.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.
Recommended action: Upgrade to 7.6.1 or 6.2.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
Recommended action: Upgrade to 7.6.1 or 6.2.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
Recommended action: Upgrade to 6.2.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Recommended action: Upgrade to 6.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
Recommended action: Upgrade to 6.1.7, 6.0.12, 4.7.17 or 4.5.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains. An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that they point to arbitrary domains, if the configuration option config.prefixLocalAnchors is used with any possible value. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. As an additional pre-condition, URL rewriting must be enabled in the web server (which it typically is) when using extensions like realurl or cooluri. Installations where config.absRefPrefix is additionally set to any value are not affected by this vulnerability. Example of affected configuration:
Recommended action: Upgrade to 7.0.2, 6.2.9 or 4.5.39 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark.
Recommended action: Upgrade to 6.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functionality."
Recommended action: Upgrade to 4.4.5, 4.3.9 or 4.2.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as demonstrated using path traversal sequences with %00 null bytes and CVE-2010-3714 to read the TYPO3 encryption key from localconf.php.
Recommended action: Upgrade to 4.4.5, 4.3.9 or 4.2.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.
Recommended action: Upgrade to 4.4.5, 4.3.9 or 4.2.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.
Recommended action: Upgrade to 4.6.8, 4.5.15 or 4.4.15 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
viewhelp.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."
Recommended action: Upgrade to 4.7.4, 4.6.12 or 4.5.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 4.7.4, 4.6.12 or 4.5.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.
Recommended action: Upgrade to 4.7.4, 4.6.12 or 4.5.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.