Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
184 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message.
Recommended action: Upgrade to 4.5.4, 4.4.9 or 4.3.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database.
Recommended action: Upgrade to 4.5.4, 4.4.9 or 4.3.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.
Recommended action: Upgrade to 4.5.4, 4.4.9 or 4.3.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.
Recommended action: Upgrade to 4.5.4, 4.4.9 or 4.3.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C (8.2) Problem It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-request-forgery. The impact is the same as described in TYPO3-CORE-SA-2020-006 (CVE-2020-11069). However, it is not limited to the same site context and does not require the attacker to be authenticated. In a worst case scenario, the attacker could create a new admin user account to compromise the system. To successfully carry out an attack, an attacker must trick his victim to access a compromised system. The victim must have an active session in the TYPO3 backend at that time. The following Same-Site cookie settings in $GLOBALS[TYPO3CONFVARS][BE][cookieSameSite] are required for an attack to be successful: SameSite=strict: malicious evil.example.org invoking TYPO3 application at good.example.org SameSite=lax or none: malicious evil.com…
Recommended action: Upgrade to 11.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C (3.5) Problem It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS['TYPO3CONFVARS']['SYS']['trustedHostsPattern'] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability. Solution Update your instance to TYPO3 version 11.5.0 which addresses the problem described. Credits Thanks to TYPO3 framework merger Benjamin Franzke who reported…
Recommended action: Upgrade to 11.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
10.4.1911.3.28.7.427.6.539.5.29· Vendor fix available
Issue
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC (5.7) Problem Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser do not consider all potentially malicious HTML tag & attribute combinations per default. In addition, the lack of comprehensive default node configuration for rich-text fields in the backend user interface fosters this malfunction. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Solution Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described above. Custom package typo3/html-sanitizer - based on allow-lists only - takes care of…
Recommended action: Upgrade to 11.3.2, 10.4.19, 9.5.29 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C (4.9) Problem It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the default configuration. Solution Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described. Credits Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue. References TYPO3-CORE-SA-2021-012
Recommended action: Upgrade to 11.3.1, 10.4.18 or 9.5.28 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem Failing to properly encode settings for backend layouts, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Solution Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described. Credits Thanks to TYPO3 core merger Oliver Bartsch who reported and fixed the issue.
Recommended action: Upgrade to 11.3.1, 10.4.18 or 9.5.28 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (4.5) Problem Failing to properly encode error messages, the components QueryGenerator and QueryView are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. Solution Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described. Credits Thanks to Richie Lee who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2021-010
Recommended action: Upgrade to 11.3.1, 10.4.18 or 9.5.28 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC (5.0) Problem Failing to properly encode Page TSconfig settings, corresponding page preview module (WebView) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Solution Update to TYPO3 versions 9.5.28, 10.4.18, 11.3.1 that fix the problem described. Credits Thanks to TYPO3 core merger Oliver Bartsch who reported and fixed the issue. References TYPO3-CORE-SA-2021-009
Recommended action: Upgrade to 11.3.1, 10.4.18 or 9.5.28 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem It has been discovered that content elements of type menu are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. Solution Update to TYPO3 versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. Credits Thanks to TYPO3 contributor Oliver Bartsch who reported and fixed the issue. References TYPO3-CORE-SA-2021-008
Recommended action: Upgrade to 11.1.1, 10.4.14 or 9.5.25 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C (5.5) CWE-405, CWE-674 Status: DRAFT Problem Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Solution Update to TYPO3 versions 9.5.25, 10.4.14, 11.1.1 that fix the problem described. Credits Thanks to Paul Keller, Mathias Bolt Lesniak and Kay Strobach who reported this issue and to TYPO3 framework merger Frank Nägler and to TYPO3 security team member Torben Hansen who fixed the issue. References TYPO3-CORE-SA-2021-005
Recommended action: Upgrade to 11.1.1, 10.4.14 or 9.5.25 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. Solution Update to TYPO3 versions 10.4.14 or 11.1.1 that fix the problem described. Credits Thanks to Richie Lee who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue. References TYPO3-CORE-SA-2021-004
Recommended action: Upgrade to 11.1.1 or 10.4.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem Due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default fileDenyPattern successfully blocked files like .htaccess or malicious.php. Besides that, attackers can persist those files in any writable directory of the corresponding TYPO3 installation. A valid backend user account with access to the form module is needed to exploit this vulnerability. Solution Update to TYPO3 versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. Credits Thanks to Richie Lee who reported this issue and to TYPO3 contributor Ralf Zimmermann who fixed the issue. References TYPO3-CORE-SA-2021-003
Recommended action: Upgrade to 11.1.1, 10.4.14 or 9.5.25 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem Due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default fileDenyPattern successfully blocked files like .htaccess or malicious.php. TYPO3 Extbase extensions, which implement a file upload and do not implement a custom TypeConverter to transform uploaded files into FileReference domain model objects are affected by the vulnerability as well, since the UploadedFileReferenceConverter of ext:form handles the file upload and will accept files of any mime-type which are persisted to the default location. In any way, uploaded files are placed in the default location /fileadmin/userupload/, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information. No authentication is required to exploit this vulnerability. Solution Update to TYPO3…
Recommended action: Upgrade to 11.1.1, 10.4.14 or 9.5.25 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem It has been discovered that database fields used as descriptionColumn are vulnerable to cross-site scripting when their content gets previewed in the page module. A valid backend user account is needed to exploit this vulnerability. Solution Update to TYPO3 versions 10.4.14, 11.1.1 that fix the problem described. Credits Thanks to Richie Lee who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue. References TYPO3-CORE-SA-2021-007
Recommended action: Upgrade to 11.1.1 or 10.4.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. Credits Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2021-006
Recommended action: Upgrade to 11.1.1, 10.4.14 or 9.5.25 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem It has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability. Solution Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described. Credits Thanks to Alexander Kellner who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue. References TYPO3-CORE-SA-2021-001
Recommended action: Upgrade to 11.1.1, 10.4.14 or 9.5.25 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.7) CWE-79 Problem It has been discovered that system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Solution Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described. Credits Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 security team members Helmut Hummel & Oliver Hader who fixed the issue. References TYPO3-CORE-SA-2020-010
Recommended action: Upgrade to 10.4.10, 9.5.23 or 8.7.38 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Problem It has been discovered that RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. Solution Update to TYPO3 version 10.4.10 that fixes the problem described.
Recommended action: Upgrade to 10.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. Solution Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described. Credits Thanks to TYPO3 security team member Helmut Hummel who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader as well as TYPO3 contributor Markus Klein who fixed the issue.
Recommended action: Upgrade to 10.4.10, 9.5.23 or 8.7.38 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0) CWE-79 --- :informationsource: This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020 --- Problem It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following. Solution Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described. Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases: TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.5) TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1) Credits Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue. References TYPO3-CORE-SA-2019-013
Recommended action: Upgrade to 9.5.6 or 8.7.25 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C (7.5) CWE-20, CWE-200 Problem In case an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php which again contains the encryptionKey as well as credentials of the database management system being used. In case a database server is directly accessible either via internet or in a shared hosting network, this allows to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions. Solution Update to TYPO3 versions 9.5.20 or 10.4.6 that fix the problem described. Credits Thanks to TYPO3 security team…
Recommended action: Upgrade to 10.4.6 or 9.5.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C (8.2) CWE-325, CWE-20, CWE-200, CWE-502 Problem It has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains as described below. TYPO3-CORE-SA-2020-007, CVE-2020-15099: Potential Privilege Escalation + the database server used for a TYPO3 installation must be accessible for an attacker (either via internet or shared hosting network) + CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C (7.5, high) TYPO3-CORE-SA-2016-013, CVE-2016-5091: Insecure Deserialization & Remote Code Execution + an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation + CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C (9.1, critical) The overall severity of this vulnerability is high (8.2)…
Recommended action: Upgrade to 10.4.6 or 9.5.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.